To ask the Secretary of State for Digital, Culture, Media and Sport, pursuant to the Answer of 9 September 2020 to Question 82137 on Data Protection: EU Law, what assessment he has made of the cost to businesses of accessing alternative legal mechanisms; and what plans the Government has in place to support businesses in accessing those mechanisms.
The UK is seeking data adequacy decisions from the EU under the GDPR and the Law Enforcement Directive (LED) and the EU’s adequacy assessment of the UK is underway. The UK remains confident that an adequacy agreement can be reached by the end of the transition period. However, we are taking sensible steps to prepare for a situation where this has not been achieved.
In such a scenario, organisations would be able to use alternative legal mechanisms to continue receiving personal data from the EU. Standard Contractual Clauses (SCCs) are the most common legal safeguard and will be the relevant mitigation for most organisations.The implementation cost for SCCs would vary between different organisations, in part depending on the size of the business in question.
DCMS is working with the Information Commissioner's Office (ICO) to ensure that all available guidance is simple, straightforward and actionable. The ICO has created an interactive SCCs tool for businesses to use and further guidance can be found on GOV.UK and the ICO’s website regarding steps organisations may be required to take relating to data protection and data flows by the end of the transition period.