No-deal Brexit could put firms in breach of GDPR

If the UK leaves the EU without a Brexit deal, organisations could find themselves in breach of the General Data Protection Regulation (GDPR) and unable to legally transfer personal data between the EU and UK, experts warn. According to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), the GDPR will be absorbed into UK law at the point of Brexit, so there will be no substantive change to the rules that most organisations need to follow. However, organisations that rely on the transfer of personal data between the European Economic Area (EEA) and UK may be affected. Under the GDPR, personal information is able to flow freely between organisations in the UK and EU without any specific measures. But this two-way free flow of personal information will no longer be the case if the UK leaves the EU without a withdrawal agreement that specifically provides for the continued flow of personal data. Data will be permitted to flow from the UK to EEA countries, however transfers of personal information from the EEA to the UK will be affected, the ICO said in December when issuing its Brexit guidance. Law firm White & Case has warned that a no-deal Brexit would change data transfers from the EU to the UK “overnight”. Transfer of personal data from the EU to the UK will need to have a lawful mechanism to be permissible under EU law, it said. This could include the use of “standard contractual clauses” that are pre-approved by the EU as satisfying its data protection requirements. Rhiannon Webster, partner and head of information law at DAC Beachcroft, told CRE: “A no-deal Brexit would mean that the UK is a third country from the date the UK leaves the EU and therefore, where data is being imported into the UK, additional protections need to be in place. These would typically take the form of a standard contract between the entity in the EU and the UK data importer, which contains a standard set of EU-approved model clauses governing the transfer.” However, getting these contracts in place invariably takes some time, said Ms Webster. “In the absence of such contracts, entities that are exporting data from the EU to the UK would be in breach of the GDPR,” she said. Ms Webster advised risk managers to track the flow of personal data between the EU and the UK, to assess where such contracts should be in place if a no-deal Brexit takes place. “In the event of a no-deal Brexit, companies should at least be able to pinpoint where the data flows are occurring and quickly take steps to bridge this compliance gap. Many of our clients have been working this into their contingency plans,” she said. Last week, the Direct Marketing Association (DMA) warned that a no-deal Brexit would raise unnecessary barriers to the free flow of data between the EU and UK. It said the threat of a no-deal Brexit had increased following the UK parliament’s rejection of Theresa May’s Brexit deal. This is causing “grave business uncertainty” and leading some UK organisations to open data centres in mainland Europe, it said. “A no-deal Brexit would create severe uncertainty for the data and marketing sector and could potentially bring EU-to-UK data flows to a halt. This would have further knock-on effects on the UK public, with jobs moving to the EU and investment also decreasing,” according to DMA chief executive Chris Combemale. Should a no-deal Brexit happen, the UK will be considered a third country when it comes to data protection law. Therefore, additional measures need to be put in place for EU countries to send their data to the UK, explained Ms Webster. The Brexit withdrawal agreement rejected by UK politicians in January would have made provision for the UK not to be a third country for a transition period. It also documented an intention for the EU to assess UK data protection law in order to grant the country an “adequacy decision”. This would essentially place the UK on a whitelist of countries outside the EU that it considers safe to send personal data to, explained Ms Webster. The DMA is calling for a transition period, in which time the UK Government should secure “adequacy status” and avoid any disruption to the free flow of data. Adequacy status allows personal data to be freely exchanged, just like the UK currently does as a member of the EU. The DMA said organisations must prepare contingency plans for a no-deal Brexit, and therefore need to look at other legal mechanisms for transferring personal data from the EU to the UK. In most cases, this means relying on standard contractual clauses to transfer data, but this would impose costs upon business.

No-deal Brexit could put firms in breach of GDPR

Want to read this article?

Read Next

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Want to read this article?

Read Next

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Related Articles