As we all continue to try to grapple with the implications of a no-deal Brexit, the last week or two has seen the publication of a few things of interest from a data protection perspective:
The EDPB’s view of data transfers in a no-deal Brexit scenario
On 12 February 2019, the European Data Protection Board (the “EDPB“) published a general information note on data transfers under the GDPR in the event of a no-deal Brexit (available here). In summary, the information note provides that organisations must comply with the GDPR when transferring personal data from the EU to the UK, which will become a “third country” for GDPR purposes (from 00.00 am CET on 30 March 2019). No new or additional safeguards are contemplated by the EDPB which effectively means that organisations must choose between:
- Standard contractual clauses (which the EDPB acknowledges are “ready to use”);
- Binding corporate rules;
- Codes of conduct or certification mechanisms (although none are yet approved/available under the GDPR); or
- Derogations such as individual explicit consent (although the EDPB emphasises that the derogations must be interpreted restrictively and mainly relate to processing activities that are occasional and non-repetitive).
For further information regarding the potential impact of a no-deal Brexit on data transfers, including an analysis of worked examples, please see our previous blog post available here.
Miriam Everett, Head of the Data Protection and Privacy group at Herbert Smith Freehills, has been working with the LexisNexis Data Protection Intelligence Group to publish a paper on Brexit and international personal data transfers: Practical approaches for the private sector in a time of uncertainty.
The paper explores how potential new international transfer restrictions (between the UK and EEA) may apply in a variety of worked examples and in the event of different Brexit outcomes. It also outlines, with practical examples, the steps that businesses may want to take to continue personal data transfers post-Brexit.
As we approach the exit date, organisations are having to critically assess international data transfers and evaluate how to legitimise such transfers in a post-Brexit world. This paper is the first of its kind (as far as the group is aware) to give detailed worked examples of how available compliance solutions could be applied to both GDPR and UK GDPR regulation.
Click here to read the full paper.
The UK Government has published a “no deal” note to clarify how data protection law will work in the event that the UK leaves the EU without a deal. The note confirms that separate draft regulations and more detailed guidance will be published in the next few weeks but, in the meantime, it clarifies at a high level a number of key issues for organisations both within the UK and outside but doing business with the UK.
The UK Digital Minister Matt Hancock has confirmed in a written statement that the General Data Protection Regulation (the “GDPR“) will come into force in the UK in May 2018 despite the UK’s move towards Brexit. Continue reading