How the change in personal data flow impacts education institutions
In June of this year, the EU adopted two adequacy decisions confirming that personal data can now flow freely from the EU to the UK.
These decisions are hugely important for education institutions and will no doubt come as a relief to many who will have been taking measures such as putting in place standard contractual clauses as the end of the post-Brexit extension loomed.
What were the adequacy decisions?
The adequacy decisions from the European Commission, which have been a long time coming, confirm that the UK is considered to have laws equivalent to those that safeguard personal data inside the European Union as well as those countries in the European Economic Area.
Since Brexit there has been a bridging mechanism that gave the European Commission another six months (until 30 June 2021) to put in place a decision, so it really did come at the eleventh hour!
Watch Our Latest Webinar
This stimulating and highly practical discussion will look at what institutions need to consider when managing change in an Education sector environment.
How will they affect education institutions?
These decisions will help education institutions that have campuses which span the UK and the EU, particularly if this is achieved by collaborations with other institutions. There will be less GDPR paperwork to fill in, as student data (and other personal data) will be able to pass freely, as it did when the UK was a member of the EU.
In a note of caution however, the European Parliament, the Member States and the European Data Protection Board expressed concerns about the possibility of future divergence from EU standards in the UK's privacy framework. In order to provide strong safeguards against dilution of privacy rights, which are considered fundamental to EU citizens, these adequacy decisions contain a 'sunset' clause. For the first time this limits the duration of adequacy to four years (previous decisions have been perpetual).
As such, and while we can all breathe a sigh of relief for a moment, education institutions will need to be mindful of the sunset clause and the potential for the UK to be without any adequacy decision in four years' time.
Consideration should be given to relationships and contracts that will go beyond this period. This is imperative to ensure that continued compliance with relevant data protection legislation and contractual provisions is possible at that time if no subsequent adequacy decision is granted.
For expert advice and support on GDPR and other commercial law, please contact our commercial team.
Get In Contact
Joanna works exclusively for higher and further education clients and has over 20 years’ experience of advising on a wide variety of student-related issues including policies and procedures, discipline, complaints and appeals, equality and immigration.