If your UK business transfers customer data to US partners, you should know about the 'UK-US Data Bridge'.
Since October 2023, this framework has simplified compliance by removing many complex safeguards previously required, provided you work with certified organisations. Think of it as a secure bridge that lets you move data across the Atlantic with confidence.
This article explores the UK-US Data Bridge and what it means for your business when transferring data to the US. Our data protection solicitors can provide you with tailored support on data transfers into and out of the UK.
Contents:
The background to transferring data compliantly
The UK General Data Protection Regulation (UK GDPR) requires that you ensure that personal data is adequately protected when you transfer it outside of the UK. If an ‘adequacy decision’ is granted by the UK, it means that you can freely send personal data to that the country, as the UK deems that country affords essentially the same level of protection to personal data as is afforded to it in the UK.
Without an adequacy decision, you need to implement ‘additional safeguards’ to transfer personal data to ‘third countries’.
If you transfer data to an organisation in the US that is certified with the UK-US Data Bridge arrangement, you can rely on the UK's partial finding of adequacy.
What is the EU-US Data Privacy Framework?
The European Commission approved the EU-US Data Privacy Framework (the DPF) in July 2023. This replaced the previous EU-US Privacy Shield (declared invalid by the Court of Justice of the European Union in the Schrems II decision of July 2020).
The DPF is a self-certification programme for US organisations, enforced by the Federal Trade Commission and Department of Transportation, and administered by the Department of Commerce. The DPF establishes enforceable principles and requirements that certifying organisations must adhere to, including a commitment to data protection assurances, to participate. Its principles include commitments to data protection and set out how organisations should use, collect and disclose personal data.
European organisations can transfer personal data from the EU to US organisations self-certifying to the DPF, without implementing additional data protection safeguards because the new DPF provides ‘adequate protection’ for personal data flows.
This key decision has helped make transatlantic data flows easier for businesses.
What is the UK-US Data Bridge?
The EU-US DPF does not extend to the UK. As a UK business, you can use the UK-US Data Bridge, an extension of the EU-US DPF that came into effect on 12 October 2023. The UK-US Data Bridge allows you to transfer personal data to US businesses that self-certify under both the EU-US DPF and the UK Extension. This removes the need to implement additional safeguards, such as SCCs or the UK IDTA, for certified US organisations.
How does the UK-US Data Bridge work in practice?
Here are some key points to note about how the UK-US Data Bridge works:
- As a UK business, you can only rely on the UK-US Data Bridge if your US recipient is certified under both the EU-US DPF and the UK Extension (as the US certification is the first key step).
- Before transferring data, you must verify the US organisation’s certification status.
- If your US recipient is not certified, you must implement alternative safeguards, e.g. the SCCs or the UK IDTA.
- If you are transferring sensitive data categories (such as criminal offence data), you may need additional protective measures, as some types of personal data may not be suitable for transfer under this mechanism. You should take legal advice if you’re unsure about the rules and what data you can transfer.
Key steps for you as a UK business
Here are some key issues for you to consider if you wish to rely on the UK-US Data Bridge:
- Update your existing privacy policies to include details on the UK-US Data Bridge and how you will transfer personal data to the US.
- Update your existing data processing activity records to accurately record any changes in how you transfer personal data to the US.
- Check that you meet all the necessary requirements before relying on the UK-US Data Bridge, e.g., whether the US business you are transferring to is actively certified under both the DPF and UK extension .
- Ensure that the UK-US Data Bridge is the correct mechanism for your data transfer. This will depend on what types of personal data you send to the US.
- Conduct due diligence on all US-based organisations with whom you intend to share personal data, regardless of the transfer mechanism you use. This is a key requirement under the UK GDPR.
- Remember that the DPF has been subject to challenges, and the UK-US Data Bridge relies on it (so you could be impacted by developments to the US framework). For extra security, you may wish to continue using other international data transfer mechanisms to transfer personal data to the US (such as the UK International Data Transfer Agreement). Remember, you have other options at your disposal. If you are unsure or need further guidance, it may be worth seeking legal advice.
Navigating the UK-US Data Bridge
If your UK business transfers personal data to the US, the UK-US Data Bridge can help reduce your costs and provide more certainty around your international data transfer mechanisms, considering the historical challenges associated with transferring personal data to the US and the time and costs required to carry out transfer risk assessments and implement contracts with US organisations.
But this isn’t a ‘quick fix’; you must ensure you meet all requirements before relying on the UK-US Data Bridge for your US data transfers.
It is important that you always approach transferring data internationally with caution and the appropriate due diligence, so please contact our data protection solicitors if you require legal advice on the UK-US Data Bridge or any aspect of UK GDPR compliance.
