Schedules Schedule 7: Transfers of personal data to third countries etc: general processing The data protection test
Article 45B sets out the data protection test which the Secretary of State must consider is met in order to make regulations approving transfers to a country or international organisation.
	Article 45B(1) provides that the data protection test is met if the standard of protection for the general processing of personal data in that country or international organisation is not materially lower than the standard of protection under the UK GDPR and relevant parts of the DPA 2018. The test therefore makes clear that:
The Secretary of State should consider the standard of protection for data subjects within the third country, in a holistic way. This is further clarified in Article 45B(3) which confirms that references to protection in the data protection test are to that protection taken as a whole. This means that the test does not require a point- by-point replication between the other country’s regime and the UK’s regime or for the destination country to take the same legal and cultural approach as the UK. Instead, the Secretary of State’s assessment will be based on outcomes, such as the overall standard of protection for a data subject;
The Secretary of State will assess whether the standard of protection is materially lower than the UK’s standard. The test recognises that other countries’ data protection regimes will not be identical to the UK’s in form and differences may exist given the cultural context of privacy. Therefore, protections in a third country do not need to be identical to those in the UK. Instead, the Secretary of State must exercise his or her discretion, in a holistic and contextual manner, to decide whether or not the overall standard of protection is lower than the UK’s standard in a way which is material;
The standard of protection in the third country or international organisation must not be materially lower than the standard of protection which applies under the UK’s regime for the general processing of personal data. The UK’s regime for general processing is contained within the UK GDPR and Part 2 and Parts 5-7 of the DPA 2018. It does not include Parts 3 and 4 DPA 2018, which govern processing by law enforcement bodies and the intelligence services respectively.
	Article 45B(2) sets out a more concise and streamlined list of matters which the Secretary of State must consider as part of deciding whether the data protection test is met. These include:
Respect for the rule of law and for human rights in the country or the international organisation;
The existence, and powers, of an enforcement authority. This requires the Secretary of State to consider how such an authority protects UK data subjects in relation to their personal data which has been transferred;
Arrangements for redress for data subjects, whether that redress is judicial or non- judicial: the Secretary of State is required to consider the redress available for data subjects. The provision recognises that redress arrangements will differ by country. For example, redress could be provided by administrative authorities instead of or in addition to judicial redress;
Rules about the transfer of personal data from the country or by the organisation to other countries or international organisations. The Secretary of State must consider how the country or international organisation ensures that personal data continues to be appropriately protected when it is transferred onwards to another country or international organisation;
Any relevant international obligations to which the country or international organisation is subject. This might include whether they are party to multilateral or regional agreements relevant to data protection or related matters. For example, the European Convention on Human Rights, or the Council of Europe Convention of 28 January 1981 for the Protection of Individuals ("Convention 108"); and
The constitution, traditions and culture of the country or organisation. This requires the Secretary of State to consider the constitutional and cultural traditions that may contribute to a country or organisation’s approach to data protection, which may differ from those in the UK.
	Article 45B(2) is a non-exhaustive list and the Secretary of State may also need to consider other matters in order to determine whether the required standard of protection exists. For example, where there are laws and practices in the third country regarding how public authorities access personal data for national security or law enforcement purposes, to the extent that they affect the overall standard of protection, the Secretary of State will take these into account.
	Article 45B(3) makes further provision about the way in which the data protection test operates, including providing that references to the protection for data subjects mean that protection taken as a whole, and that references to the processing of personal data in the third country mean the processing of personal data transferred to the country or organisation under the UK GDPR (and not, for example, other personal data derived from within that third country).
	Article 45B(4) clarifies that where the Secretary of State makes regulations which only apply to some transfers to a country or international organisation, the relevant requirements and provisions in Article 45B only refer to the transfers permitted by the regulation, and the reference to rules for onward transfers includes rules on transfers elsewhere within that country as well as outside of it.