On August 11, 2021, the Information Commissioner’s Office (ICO) launched a public consultation on several transfer documents, including its draft International Data Transfer Agreement (IDTA). The proposal includes the ICO’s draft International Transfer Risk Assessment (TRA) tool, which is designed to assist organizations when conducting TRAs for restricted transfers to countries without an adequacy decision.

The IDTA is set to replace the current Standard Contractual Clauses (SCCs) and has been developed in line with the CJEU’s decision in the Schrems II case to enable to the continued flow of data with a high level of personal data protection.

The ICO is seeking comments on relevant privacy rights as well as legal, economic, or policy implications to further understand the practical impact of the proposal into consideration. The public consultation is to be divided into three sections, including;

The consultation period for the draft IDTA and guidance ends on October 7, 2021.

Speaking on the draft IDTA, Steve Wood, Executive Director of Regulatory Strategy at the ICO, said: “The modern world involves increasing flows of personal data about citizens to deliver goods and services. Ensuring data is well-protected when transferred outside of the UK will be vital in maintaining people’s trust in the system. Our new IDTA is developed to ensure such protections are in place.”

What is the ICO’s Draft International Data Transfer Agreement?

The draft IDTA is a set of contractual requirements that organizations can use when transferring data to a third country. It serves as one of the appropriate safeguards under Article 46 of the UK GDPR and is set to replace the current set of SCCs.

The IDTA will provide organizations with a baseline of safeguards that offer a sufficiently similar legal standard to that found under the UK GDPR for data transfers to countries without an adequacy decision. The draft IDTA also includes guidance on how to complete the IDTA, including templates and frequently asked questions.

It is important to note that the IDTA plans to require organizations to conduct a TRA to ensure that the safeguards provided by the IDTA do not conflict with third-country legislation and that a sufficient level of data protection is achieved.

What is the International Transfer Risk Assessment Tool?

The ICO has also launched its TRA tool to assist organizations when carrying out a TRA. The TRA tool sets out a structured methodology for organizations to utilize when conducting a TRA including guidance and decision trees.

Similar to the EDPB’s six-step roadmap for supplementary measures, the ICO’s TRA tool breaks the TRA down into three parts:

  1. Assessing the transfer,
  2. Determining whether the IDTA likely to be enforceable in the destination country, and
  3. Determining if there is appropriate protection for the data from third-party access.

Organizations should carry out a TRA when making a restricted transfer that relies on an Article 46 transfer tool – this includes the IDTA.

However, a TRA is not necessary when transferring personal data to any country covered by UK adequacy regulations or if the transfer is covered by an exception such as the data subject giving explicit consent for the transfer.

UK Addendum to the European Commission Standard Contractual Clauses

In addition to the IDTA and TRA tool, the ICO launched a draft addendum to the EU SCCs as well as New Zealand’s SCCs and ASEAN SCCs for public consultation. The ICO outlined that the addendum will provide additional appropriate safeguards for organizations relying on Article 46 transfer tools under the UK GDPR when transferring data out of the UK.

The public consultation on draft IDTA, TRA tool, and international transfer guidance will close at 5 pm BST on October 7, 2021. Comments can be submitted by emailing a completed consultation paper to [email protected]

Further reading on the ICO’s International Data Transfer Agreement and Tool:

Follow OneTrust on LinkedIn, Twitter, or YouTube for the latest on the ICO Draft International Data Transfer Agreement.