On 8 June 2023, the UK Government announced that it had reached a commitment with the US to establish a "data bridge". Please see the press release here.
Key development
If finalised, the data bridge will operate as a UK extension to the EU-US Data Privacy Framework which is currently working its way through the European Commission's adequacy assessment process. In a similar way to the UK Addendum to the EU Standard Contractual Clauses, this will ensure pan-European organisations are able to take an aligned approach to data transfers.
Much like the previous Safe Harbor and Privacy Shield regimes, US companies who are eligible to opt-in and are approved to join the Framework, would be able to receive UK personal data under the new UK-US data bridge. Notably, it will have the same limitations as the previous iterations, including a requirement that the relevant US participant be regulated by the Federal Trade Commission or the Department of Transportation, which excludes recipients in the financial services sector.
What happens next
The UK - US data bridge is reliant on the approval of the EU - US framework. The final text of the adequacy decision is being prepared by the European Commission, before it will be referred to the committee of EU Member States Representatives for approval.
In the meantime, organisations should continue to use the current appropriate transfer mechanisms, whilst monitoring developments.
