On December 24th, with a year-end deadline and the holidays fast approaching, European Commission and United Kingdom (“UK”) officials announced they reached a deal on the EU-UK Trade and Cooperation Agreement (“Agreement”).  Once formally adopted by the European Union (“EU”) institutions, the Agreement will govern the relationship between the EU and UK beginning on January 1, 2021, following the end of the Brexit transition period.

The Agreement is likely to avert a year-end scramble to secure cross-border data transfers between the EU and the UK.  Although the final text has not yet been published, a UK government summary of the deal indicates that the parties agreed to allow for the continued free flow of personal data for up to six months to allow time for the EU and UK to adopt mutual “adequacy decisions,” in which each jurisdiction may recognize the other as offering adequate protection for transferred personal data.  Absent these adequacy decisions (and the interim period established by the Agreement), organizations would need to consider implementing additional safeguards, such as standard contractual clauses, to transfer personal data between the EU and UK.

The Agreement provides commitments from both the EU and UK to uphold high levels of data protection standards and to refrain from adopting data localization requirements.  The Agreement also provides for cooperation and sharing of Passenger Name Records, criminal record information, as well as DNA, fingerprint and vehicle registration data.

Following the announcement, the Agreement was sent to the Council of the EU.  If approved by all 27 EU Member States, the Council will agree to the provisional application of the Agreement on January 1, 2021.  The European Parliament, which declined to vote on the deal before the end of this year, will have the opportunity to review the Agreement in January.