ICO publishes opinion on UK-US Data Bridge

The Information Commissioner's Office (ICO) has published its official opinion of the UK-US Data Bridge, the adequacy agreement for the UK Extension to the EU-US Data Privacy Framework (DPF) announced by the Department of Science, Innovation and Technology (DSIT). 

Although the Secretary of State concluded that the UK Extension provides an adequate level of data protection and has laid regulations to that effect, the ICO identified four specific areas that could pose risks to UK data subjects if the protections identified are not correctly applied. 

Those risks are: 

• The definition of sensitive information does not specify all the categories listed in Article 9 of the UK General Data Protection Regulation (GDPR).
• There are no equivalent protections to those outlined in the UK's Rehabilitation of Offenders Act 1974, which places restrictions on the use of data related to criminal convictions that have become 'spent' after the rehabilitation period
• There is a lack of protection in providing individuals with a right to a review of an automated decision by a human. 
• The UK Extension does not include a right to be forgotten or an unconditional right to withdraw consent.
  

To ensure that UK data subjects are afforded equivalent protection in practice, and their rights are not undermined, the ICO recommends that the Secretary of State closely monitor these areas. Additionally, the ICO highlights that the implementation of the UK Extension should be monitored to ensure it operates as intended.