The ‘data bridge’ between the UK and the USA
News
The ‘data bridge’ between the UK and the USA
June 13 2023
As you may know, international data transfers are at the heart of commercial transactions, and the USA is one of the UK’s major trading partners in data-driven exports. After two years of technical discussions and coinciding with the United Kingdom (UK) Prime Minister’s visit to the United States of America (USA), the UK and the USA are expected to set up a data bridge. The ‘commitment in principle’ represents a UK extension to the Data Privacy Framework agreed between the EU and US in 2022. The US government said that it would make it easier for UK businesses to transfer data freely to certified US organisations without cumbersome red tape. US companies approved to join the framework, would be able to receive UK personal data under the new data bridge.
Despite this relationship, red tape is a pain but yet, an unavoidable element in current discussions. The EU GDPR and its equivalent in the UK impose restrictions on the international transfer of personal data. Most concerned companies needing to send personal data to a service provider or company in the USA have to set up different mechanisms provided under the GDPR that business can rely on for ensuring EU, or UK, data protection standards continue to apply to personal data when exported. One of those mechanisms are costly contractual clauses to ensure compliance with protection and privacy standards.
Adequacy decisions are another mechanism. These are designations made by policymakers that enable the free flow of personal data to the designated jurisdictions. A data bridge would be positive for the following reasons:
- removing administrative burdens,
- speeding up processes for businesses,
- reducing costs, and
- increasing opportunities by making it easier for UK companies to do business and trade internationally.
However, the announcement made by the US Secretary of State for Commerce, Gina M. Raimondole, and by the UK Secretary of State for Science, Innovation and Technology, Chloe Smith MP, differ.
On the American side…
The announcement includes the goal of “facilitating data flows between our countries while ensuring strong and effective privacy protections”, without indicating how this will be achieved. There are references to “trust in the digital economy” and to the OECD declaration on government access to personal data held by private sector entities, there is no mention to privacy protections at federal or state level.
From the UK side…
At the same time as discussions are taking place with the European institutions, this new mechanism would be an extension of the EU-US Data Privacy Framework (DPF). This preliminary DPF is designed to revamp the previous Privacy Shield arrangement between the US and EU, which was ruled unlawful in 2020 under GDPR rules in the Schrems II case.
The possible adequacy decision would allow data transfers from the EU to US organizations certified for this system. This announcement would align the position of the UK GDPR with that of the EU GDPR.
Aware of its desire to retain its declaration of adequacy with the European Union, the UK explicitly states that the “data bridge will support the rights of data subjects”. It then adds the commercial objective of “facilitating responsible innovation”.
”“International collaboration is key to our science and technology superpower ambitions, and working with global partners like the United States ensures we can open new opportunities to grow our innovation economy”
Chloe SmithThe UK’s Secretary of State for Science, Innovation, and Technology
To be continued…
Further discussions and technical research will be carried out over the coming months before any decision is taken on the implementation of the data bridge. In the future, the aim is to enable US organizations that meet the required certification conditions to join the data protection framework. A parallel can be drawn with the Republic of Korea, the UK’s key partner; British companies can share personal data with the Republic of Korea securely and without restrictions. When finalised, the UK-US data bridge would constitute a UK-issued adequacy decision.
Victoria Derumier
