UK Government advises firms to prepare for data disruption in no-deal Brexit

A Brexit no-deal would obstruct the free flow of personal data from the European Union (EU) to the UK, the UK Government has warned, going on to urge its firms to proactively address potential disruptions. The European Commission (EC) has said it will not agree to put in place, or enter discussions over, arrangements that would allow the continued flow of personal data from EU companies, including subsidiaries, to UK firms until the country leaves the bloc and becomes a third country. In a series of technical guidance in preparation for a no-deal scenario between the EU and UK, the Department for Digital, Culture, Media and Sport said UK companies could continue to transfer personal data to companies or subsidiaries in the EU as before, but a reciprocal arrangement is less certain. Stressing that it continues to believe a no-deal is unlikely come March 2019, the UK Government reiterated that the collection and use of personal data is regulated by the EU’s General Data Protection Regulation (GDPR). Under these rules, firms can only transfer personal data outside the EU where there is legal basis, while personal data can be transferred within EU countries without restriction. “The legal framework governing transfers of personal data from organisations (or subsidiaries) established in the EU to organisations established in the UK would change on exit,” the government said. “The UK would at the point of exit continue to allow the free flow of personal data from the UK to the EU. The UK would keep this under review,” it added. The EC uses adequacy, or equivalence, decisions to grant the flow of personal data to countries outside the EU. This would also apply to the UK should it fail to broker a deal with the EU. “The European Commission has stated that if it deems the UK’s level of personal data protection essentially equivalent to that of the EU, it would make an adequacy decision allowing the transfer of personal data to the UK without restrictions,” said the UK government. “While we have made it clear we are ready to begin preliminary discussions on an adequacy assessment now, the European Commission has not yet indicated a timetable for this and has stated that the decision on adequacy cannot be taken until we are a third country,” it added. The UK Government said this may not be agreed on point of exit and UK companies should establish a legal basis with EU firms, including data centres, to continue receiving personal data from EU firms from March 2019. “The most relevant alternative legal basis would be standard contractual clauses. These are model data protection clauses that have been approved by the European Commission and enable the free flow of personal data when embedded in a contract,” it explained. In the event of a no-deal, the UK would continue to comply with the GDPR. Under the UK Data Protection Act 2018 and the EU Withdrawal Act, the country would incorporate GDPR into UK law. “The clauses contain contractual obligations on you and your EU partner, and rights for the individuals whose personal data is transferred. In certain circumstances, your EU partners may alternatively be able to rely on a derogation to transfer personal data,” said the UK Government.

UK Government advises firms to prepare for data disruption in no-deal Brexit

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Related Articles