ICO consults on how organisations can continue to protect personal data when it is transferred outside of the UK
August 2021
The Information Commissioner’s Office (ICO) has confirmed that it has launched a public consultation on its draft international data transfer agreement (IDTA) and guidance.
- When organisations send personal information to a country outside the UK, they must ensure people’s data protection rights continue to be protected. An IDTA is a contract that organisations can use when transferring data to countries not covered by adequacy decisions
- The IDTA will replace the current standard contractual clauses (SCCs) to take into account the binding judgment of the European Court of Justice in a case commonly known as ‘Schrems II’. The ruling required organisations to carry out further diligence when making a transfer of personal data outside of the UK to countries without an adequacy decision
- The consultation is split into three sections, offering a selection of proposals and options to consider
- Proposal and plans for updates to guidance on international transfers.
- Transfer risk assessments.
- The international data transfer agreement.
Firms which wish, or need, to transfer personal data outside of the UK need to be aware of the Consultation and should consider responding. The ICO is also asking for views on any relevant privacy rights, legal, economic or policy considerations and implications. Responses will help the regulator understand the practical impact of proposed approaches on organisations.
Back to news...