The UK and the US have reached an agreement to establish a data bridge for the free flow of data between the two countries.

Following adequacy regulations being finalised in the UK parliament as of 12 September, the regulations will come into effect from 12 October, transforming the requirements for international data transfers between the UK and US.

Recently, the US also formed a data bridge with the European Union in an adequacy agreement not seen since the landmark Shrems II case. This dismantled the previous data transfer agreements between the US and the EU after it was disclosed that the US National Security Agency (NSA) was investigating the personal data of foreigners without their consent.

What made the UK-US data bridge possible is an adequacy decision driven by US Executive Order 14086, which guarantees certain “qualifying states” data rights within the US, including the ability to access a redress mechanism if individuals feel their data had been unlawfully viewed, intercepted, or investigated by US intelligence services.

Initially a provision for the EU and three more member states of the European Economic Area, the UK was designated as a qualifying state on 18 September.

Following this, UK secretary for sciences, innovation, and technology Michelle Donelan said that the decision did not undermine the data rights of UK citizens and laid the adequacy regulations in Parliament.

Back in June, the UK and US met to agree on their intention of building the data bridge, intending for the data bridge to be an extension of the EU-US data adequacy agreement.

Recommended

• Landmark EU-US Data Privacy Framework Adopted
• EU-US AI Agreement: Could the UK Fall Behind?
• UK-US Data Bridge In the Works

The UK-US data bridge would enable the faster, more efficient transfer of data between the two countries without specific legal agreements for every data transfer from the UK to the US. It also formalises the protections of UK citizens’ personal data when it is transferred to the US.

However, the adequacy agreement is not without controversy – None of Your Business (NOYB), the data protection rights group, already has intentions to file against the EU-US data agreement, on which the UK-US data bridge relies on.

“The EU-US. Data Privacy Framework is already seeing legal challenges on the basis that it does not do enough to protect EU citizens whose personal data is transferred to the U.S. Any such challenges will likely take months, more likely years, to work their way through the courts,” Georgina Graham, privacy and technology partner, Osborne Clarke commented.

“In the event that a challenge to the EU-U.S. Data Privacy Framework is successful, or the European Commission reverses its approval of the framework, it is not clear whether the UK-U.S. data bridge would also be invalidated. The fact that the UK-U.S. data bridge is an extension to the EU-U.S. Data Privacy Framework, and a U.S. business must participate in the EU-U.S. Data Privacy Framework to be able to participate in the UK-U.S. data bridge, suggests that the UK-U.S. data bridge will only remain valid for as long as the EU-U.S. Data Privacy Framework remains valid, but we don’t yet know that for sure.”