ICO consults on draft international data transfer terms

Draft contractual terms, and associated guidance, to allow organisations to send personal data to foreign countries not covered by adequacy decisions have been put out to consultation by the Information Commissioner’s Office.

Once finalised, the ICO's international data transfer agreement (IDTA) will replace the current standard contractual clauses ("SCCs") to take into account the binding judgment of the European Court of Justice in the Schrems II case. The ruling required organisations to carry out further diligence when making a transfer of personal data outside of the UK to countries without an adequacy decision. When organisations send personal information to a country outside the UK, they must ensure people’s data protection rights continue to be protected.

Part of the ICO's duties under s 119A of the Data Protection Act 2018, the new IDTA will support the UK’s digital economy by continuing to enable the global flow of people’s information with the safeguards of high standards of data protection.

The consultation is split into three sections, offering a selection of proposals and options to consider:

• proposal and plans for updates to guidance on international transfers;
• transfer risk assessments; and 
• the international data transfer agreement.

The ICO is also asking for views on any relevant privacy rights, legal, economic or policy considerations and implications. Responses will help it understand the practical impact of proposed approaches on organisations.

Steve Wood, ICO executive director of Regulatory Strategy, commented: "The modern world involves increasing flows of personal data about citizens to deliver goods and services. Ensuring data is well protected when transferred outside of the UK will be vital in maintaining people’s trust in the system. Our new IDTA is developed to ensure such protections are in place.

"We understand that international transfers can be complex, especially for smaller businesses. Our new guidance has been designed to be accessible and to ensure they support all organisations, from SMEs without the benefit of large legal budgets to multinational companies. The agreements will help organisations to continue to trade freely while ensuring the correct protections are in place before transferring people's data."

He emphasised: "This consultation is important. We know how important it is for transfer tools to work in practice, and the ICO wants to support businesses in this area. The responses we receive will inform our final work and I encourage all organisations that undertake international transfers to engage with the consultation and provide feedback."

The consultation (click here to access) will inform the final documents the ICO will lay before Parliament. The deadline for responses is 5pm on 7 October 2021.