A (data) bridge to... the US: How the EU's American dream will extend to the UK

The UK and US governments are committed in principle to ensuring the free flow of personal data between the two countries without burdensome red tape.

On 8 June 2023, the UK and US governments jointly announced their commitment to establish a “data bridge” to operate as a UK extension to the EU/US Data Privacy Framework (the DPF). However, the implementation of this is conditional on:

• The UK’s assessment of US data protection laws and practices.
• Further technical work being finalised.
• The US designating the UK as a qualifying state under Executive Order 14086.

Now that the EC has adopted an adequacy decision for transfers of personal data from the EU to the US under DPF, we would expect movement on this data bridge to follow swiftly.

Key Takeaways

• The data bridge was announced as part of a wider “Atlantic Declaration” between the two countries which sets out a comprehensive action plan for the UK and US to secure their economic future, including data flows and the safe development of emerging technologies.
• The data bridge is intended to be finalised in 2023.
• As part of its assessment of US data protection laws and practices, the UK will consider the protection provided for personal data, the rule of law, respect for human rights and fundamental freedoms, and the existence and effective functioning of a regulator in the US. This should not be too dissimilar to the approach the EC has taken with regard to the DPF.
• Once adopted, the data bridge will allow personal data to be transferred more freely and securely between the UK and US without the need to rely on the UK’s Addendum to the EU Standard Contractual Clauses or the International Data Transfer Agreement. These mechanisms have largely been criticised for being costly and time consuming.
• It is estimated that the data bridge, and the free flow of personal data, will translate into an estimated £92.4 million in direct savings per year.

Our View

A data bridge, or UK extension, to the DPF would certainly be welcome by the many businesses that rely on transfers from the UK to the US; a number which is estimated at around 55,000 businesses.

The data bridge would provide a relief from much of the administrative and cost burden that has been caused by transfer risk assessments, considering additional safeguards and international data agreements.

Schrems II, coupled with the post-Brexit UK data protection landscape, has not made it an easy couple of years for those businesses that need to make international transfers with many having to update their standard contractual documents and enter into new arrangements. The DPF appears to simplify this process into a certification scheme, as we detail further in our article “The American Dream Comes True for EU Businesses That Export Data to the US”.

Although the DPF has been adopted, the exact mechanics of the data bridge are largely unknown, so we await a further update from the UK and US governments. Whether the data bridge operates in the exact same manner as the DPF, or has some subtle differences, will likely depend on the outcome of the conditional elements noted above. However, we will no doubt need to keep any eye out for any challenges to the DPF (which are possible) and hope that the data bridge is robust enough and capable of surviving any chaos that a “Schrems III” could bring with it.