Post-Brexit – data transfers

Nigel Miller (partner)

As the UK and the EU have now reached a deal on Brexit, what’s the position on data transfers as from 1 January 2021?

Here’s a high-level summary:

Transfers from UK to EEA – these will be subject to UK GDPR. The UK government has confirmed that such transfers are not restricted and so can continue as before without the need for any transfer tool to be put in place.

Transfers from UK to third countries outside the EEA – the position remains similar to the current GDPR rules. Although the UK will in due course make its own adequacy decisions, for the time being existing EU adequacy decisions and the EU approved standard contractual clauses will continue to be recognised.

Transfers from EEA to UK from 1 January 2021 the UK is a “third country” so far as EU GDPR is concerned; therefore, transfers from EEA to UK will be restricted transfers. The UK was seeking an “adequacy decision” from the European Commission as part of the Brexit deal to permit such transfers to continue without the need for a transfer tool to be put in place. A joint declaration published alongside the deal makes clear that the EU will undertake this adequacy assessment. However, an adequacy decision was not part of the deal. Pending this, a temporary arrangement has been agreed to allow data to continue to be transferred from the EEA to the UK for the next four months (extendable to six months).

Given this temporary arrangement, thankfully it is not necessary for organisations involved in such transfers to rush to put in place standard contractual clauses or another transfer tool as from 1 January. However, this will need to be kept under careful review in Q1 and Q2 2021.

Transfers to the US which relied on Privacy Shield – as a result of the Schrems II decision in July 2020, which invalidated the Privacy Shield arrangement, another transfer tool needs to be put in place, such as standard contractual clauses. But see next point.

Using standard contractual clauses – as well as transfers which have become restricted transfers as a result of Brexit, all restricted transfers will need to be reviewed in 2021 with the implementation of the proposed new standard contractual clauses issued by the European Commission in November 2020 – see https://idatalaw.com/2020/11/20/new-standard-contractual-clauses/

In addition to the above, following Schrems II, in order to rely on standard contractual clauses organisations must carry out a “transfer impact assessment” to determine whether the clauses guarantee an equivalent level of protection for the transferred data as applies under GDPR; if implementation of SCCs alone would not guarantee an equivalent level of protection, then “supplementary measures” need to be put in place to ensure such a level of protection – see further https://idatalaw.com/2020/11/20/new-guidance-for-international-transfers-post-schrems-ii/

Putting aside international transfers for a moment, we wish you all the best for a healthy and successful 2021!

Six data protection steps for return to the workplace

As lock-down restrictions start to ease and businesses begin to reopen, the ICO has set out the key steps organisations need to consider around the use of personal information.

Six key steps:

The six key data protection steps are:

Only collect and use what’s necessary

This reflects the data protection principle of “purpose limitation”.

To help you decide if collecting and using people’s health data is necessary to keep your staff safe, you should ask yourself a few questions:

  • How will collecting extra personal information help keep your workplace safe?
  • Do you really need the information?
  • Will the test you’re considering actually help you provide a safe environment?
  • Could you achieve the same result without collecting personal information?

If you can show that your approach is reasonable, fair and proportionate to the circumstances, then it is unlikely to raise data protection concerns.

Keep it to a minimum

This reflects the data protection principle of “data minimisation”.

When collecting personal information, including people’s Covid-19 symptoms or any related test results, organisations should collect only the information needed to implement their measures appropriately and effectively.

Don’t collect personal data that you don’t need. In some case, some information only needs to be held for a short period, and there is no need to create a permanent record.

Be clear, open and honest with staff about their data

This reflects the data protection principle of “transparency”; people have a right to know their information will be handled.

Some people may be affected by some of the measures you intend to implement. For example, staff may not be able to work. You must be mindful of this, and make sure you tell people how and why you wish to use their personal information, including what the implications for them will be. You should also let employees know who you will share their information with and for how long you intend to keep it. You can do this through a clear, accessible privacy notice.

Treat people fairly

This reflects the data protection principle of “fairness”.

If you’re making decisions about your staff based on the health information you collect, you must make sure your approach is fair. Think carefully about any detriment they might suffer as a result of your policy, and make sure your approach doesn’t cause any kind of discrimination.

Keep people’s information secure

This reflects the data protection principles of “integrity and confidentiality” and “storage limitation”.

Any personal data you hold must be kept securely and only held for as long as is necessary.

Staff must be able to exercise their information rights

As with any data collection, organisations must inform individuals about their rights in relation to their personal data, such as the right of access or rectification. Staff must have the option to exercise those rights if they wish to do so, and to discuss any concerns they may have with organisations.

Legal basis for processing:

As well as following these principles, if you decide to implement symptom checking or testing, you must identify a lawful basis for using the information you collect.

We would suggest that employers avoid reliance on “consent” as the legal basis, as employee consent is unlikely to be valid for data protection purposes as employees do not have a free and genuine choice. The most appropriate legal basis, therefore, will be that the collection of health data is in the “legitimate interests” of the employer, such interests not being overridden by the interests of the employees.

In addition, as health data is one of the “special categories” of personal data, an additional lawful basis is required.  Again, we would suggest that employers avoid reliance on “explicit consent”, and instead rely on the necessity to process the information to comply with the employer’s health and safety at work obligations.

Finally, if you are processing health data on a “large-scale”, you will also need to conduct a “data protection impact assessment” (DPIA). The GDPR does not define what constitutes large-scale. In essence, this will be determined mainly by the number of employees involved. While a small business is unlikely to be processing employee data on a large-scale, even if you are not strictly required to carry out a DPIA, it is good practice to do so.

Our recommendations:

  • Provide a Covid-19 specific privacy notice to your employees, as a supplement to your general staff privacy notice.
  • Supplement your data retention policy to set out when personal information collected must be reviewed, deleted or anonymised.
  • If you are collecting employee health data, or checking and testing, document your legitimate interests assessment (LIA). This does not have to be in any particular form but should address the three tests: the purpose test (identify the legitimate interest); the necessity test (consider if the processing is necessary); and the balancing test (consider the individual’s interests).
  • Consider how the information will be stored to ensure it is kept secure, and who will have access to the information.
  • Do you have an internal data subject access request policy? If not, it’s a good time to introduce one to ensure DSARs are handled effectively.
  • If you are processing health data on a large scale, or just to comply with good practice, prepare a data protection impact assessment. This can be done as part of your wider return to work risk assessment.

 

Contact us

If you have any questions about these issues in relation to your own organisation, please contact a member of the team or speak with your usual Fox Williams contact.