Question to the Department for Digital, Culture, Media & Sport:

To ask Her Majesty's Government whether, after the end of the transition period on 31 December 2020, Northern Ireland will be subject to the EU General Data Protection Regulation rules on data transfer even if the rest of the UK decides to introduce new rules.

At the end of the transition period, the European Union (Withdrawal) Act 2018 (EUWA) will incorporate direct EU legislation into UK law, as well as saving EU-derived domestic legislation – collectively referred to as 'retained EU law'. The General Data Protection Regulation (GDPR) will become retained EU law for the whole of the UK.

We have made Regulations under the EUWA to make necessary and appropriate changes to the GDPR, which will become the UK GDPR, and the Data Protection Act 2018 so that the UK’s data protection law continues to function effectively after the transition period.

In respect of data transfer rules, the EU has an established mechanism to allow the unrestricted transfer (subject to GDPR compliance) of personal data to countries outside the EU, called ‘adequacy decisions’. At the end of the transition period, the UK will recognise EEA countries as continuing to be adequate for the purpose of the UK GDPR, so data can continue to flow from the UK to the EEA. In order for the free flow of data from the EEA to the UK to continue at the end of the transition period, we are seeking adequacy decisions from the EU under both the GDPR and the Law Enforcement Directive (LED). Adequacy talks between the UK and the EU began on 11 March and continue to progress.