The US and UK have reached an agreement to build a “data bridge” that will allow the free flow of data between the two regions.
This ‘in principle commitment’ represents the UK’s extension of the data privacy framework agreed between the EU and the US in 2022. This means that US companies approved to participate in the framework can receive UK personal data.
The preliminary Data Privacy Framework is designed to overhaul the previous Privacy Shield Agreement between the US and EU, which was held illegal under GDPR rules in the 2020 Schrems II case.
A UK government statement said the new deal between the UK and the US follows two years of technical talks between the two governments “before a final decision is made on whether to establish a data bridge.” Further work is expected to be completed in the coming months.
Both parties stressed that the deal aims to boost economic growth and promote innovation in areas such as science and research.
Chloe Smith, UK Secretary of State for Science, Innovation and Technology, commented: “DataBridge not only provides an easier means to securely transfer personal data between countries, it also removes bureaucratic hassles for businesses of all sizes and access new markets.
“International cooperation is key to the ambitions of a science and technology powerhouse, and working with a global partner like the United States can certainly open up new opportunities to grow the innovation economy,” she added. .
The White House said in a statement: “The reliable and secure flow of data across borders is the cornerstone of our further innovation efforts. We are committed to establishing a data bridge between the US and UK to facilitate data flow between them, and we are working to quickly finalize our respective assessments to implement this framework.”
Commenting on the news, Sarah Pearce, partner at Hunton Andrews Curse, said: “This is very welcome news. It will not only make it easier for people to move from the UK to the US, but it will also improve the relationship between the UK and the EU. It also shows that we are in agreement,” he said. Respect for data transfers to the United States.
“The idea is that U.S. companies that are approved to participate in this framework will be able to receive personal data without the need for the additional contractual clauses that are currently required,” Pearce added.
In a blog post by law firm Pinsent Masons, senior practice development attorney Rosie Nance welcomed the announcement and said the approach to extending the EU-US agreement, rather than a single agreement, would “reach a political agreement.” It is likely to be the smoothest approach for ”
He added that “the UK’s approach would probably be in line with the EU’s, so it would be the least likely to pose a problem to the UK’s own EU adequacy status.”
In March 2023, the UK government introduced the Data Protection and Digital Information (DPDI) bill to parliament to amend the current GDPR rules. The main purpose is to reduce the cost and complexity of transferring and using data for businesses.
But experts warn that the provision could not only undermine consumer privacy rights, but could jeopardize the adequacy agreement between the UK and the EU.
