How the change in personal data flow impacts education institutions
In June of this year, the EU adopted two adequacy decisions confirming that personal data can now flow freely from the EU to the UK.
These decisions are hugely important for education institutions and will no doubt come as a relief to many who will have been taking measures such as putting in place standard contractual clauses as the end of the post-Brexit extension loomed.
What were the adequacy decisions?
The adequacy decisions from the European Commission, which have been a long time coming, confirm that the UK is considered to have laws equivalent to those that safeguard personal data inside the European Union as well as those countries in the European Economic Area.
Since Brexit there has been a bridging mechanism that gave the European Commission another six months (until 30 June 2021) to put in place a decision, so it really did come at the eleventh hour!
How will they affect education institutions?
These decisions will help education institutions that have campuses which span the UK and the EU, particularly if this is achieved by collaborations with other institutions. There will be less GDPR paperwork to fill in, as student data (and other personal data) will be able to pass freely, as it did when the UK was a member of the EU.
In a note of caution however, the European Parliament, the Member States and the European Data Protection Board expressed concerns about the possibility of future divergence from EU standards in the UK's privacy framework. In order to provide strong safeguards against dilution of privacy rights, which are considered fundamental to EU citizens, these adequacy decisions contain a 'sunset' clause. For the first time this limits the duration of adequacy to four years (previous decisions have been perpetual).
As such, and while we can all breathe a sigh of relief for a moment, education institutions will need to be mindful of the sunset clause and the potential for the UK to be without any adequacy decision in four years' time.
Consideration should be given to relationships and contracts that will go beyond this period. This is imperative to ensure that continued compliance with relevant data protection legislation and contractual provisions is possible at that time if no subsequent adequacy decision is granted.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
