Katarzyna
Malinowska
What’s Up
Insurance distribution and data protection vs Brexit
As of 31 December, the transition period associated with the cessation of the UK’s membership of the European Union ended. As a result, it is necessary to pay closer attention to relations with insurance distributors from the UK, who no longer enjoy the freedoms of service and establishment to offer insurance in the territory of Poland. They must therefore be authorised to operate in one of the Member States of the European Union, as is the case with Lloyds established in Belgium.
A related problem is also the flow of personal data to Great Britain, which currently has the status of a third country. In this context, it is important to bear in mind the relevant provisions of the RODO governing the specific rules under which transfers of personal data to third countries may take place.
Good news for intermediaries working with UK-based entities is the extension of the transitional period allowing the free flow of personal data to the UK – until 1 July 2021. This provision is reflected in the bridging clause found in the final provisions of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community and the United Kingdom of Great Britain. This agreement will govern the future relationship of the European Union with the United Kingdom. The definition of the transitional provisions that relate to the transfer of data to the United Kingdom follows from Article FINPROV 10A of the said Agreement. It is important to note that such transfers of personal data will temporarily not be considered as transfers to a third country.
Therefore, businesses will not be required to comply with additional requirements, which are detailed in Chapter V of the RODO. Such a solution also includes additional requirements for international data transfers expressed in Chapter 3a of the Act of 16 September 2011 on the exchange of information with law enforcement authorities of European Union Member States, third countries, European Union agencies and international organisations, which implements Chapter V of Directive (EU) 2016/680 in the Polish legal order. The transitional period will last until 1 July 2021 at the longest. (a period of four months is included in the Agreement, but it will automatically be extended by another two months unless one of the parties to the Agreement objects to this). The transitional period may end earlier if the European Commission under Article 36(3) of Directive (EU) 2016/680 and under Article 45(3) of the RODO issues implementing decisions finding an adequate level of data protection in the UK.
If the European Commission has not issued an adequacy decision at that time, the transfer of data to the UK after the transition period will require the safeguards set out in Article 46 of the RODO, for example standard contractual clauses or binding corporate rules. The condition for the free flow of data during the transitional period will primarily be that the UK maintains the data protection rules based on EU law, i.e. the RODO and Directive (EU) 2016/680, in force from 31 December 2020.