ANDRE THOMPSON, PRIVACY COUNSEL AND DATA PROTECTION OFFICER AT TRŪATA PROVIDES COMMENTARY TO IDG CONNECT
With negotiations at an impasse, a no-deal Brexit is looking ever more likely. If we get to Dec 31st without a withdrawal agreement, how will this affect the transfer of personal data between the EU and UK?
Unless a Brexit withdrawal agreement is able to be made – and ratified – in the next few weeks which includes a data adequacy decision, the UK is set to become a ‘third country’ from a data protection perspective.
This means that from January 1st 2021, further measures and contracts will be required regarding transfers of personal data from Europe to the UK, adding an additional compliance burden to EEA companies that do business in the UK or have UK subsidiaries.
“The importance of personal data flows to the UK economy can’t be overstated,” continues Andre Thompson, Privacy Counsel and Data Protection Officer at Trūata. “EU companies could easily look to options in other EU member states which require little or no additional compliance burdens. There may also be a knock-on impact of job losses from functions like human resources moving some operations out of the UK into the EU as cost-saving measures.”
Granting a data adequacy decision
“Adequacy decisions require a detailed examination of the country’s data protection environment, which usually takes months, or even years, to complete, and in the UK’s case, the Court of Justice of the European Union (CJEU) recently ruled one of the UK’s state surveillance laws to be unlawful under EU law,” she points out.
“The EU’s granted little more than 10 data adequacy decisions in the past,” continues Enza Iannopollo, a senior analyst at Forrester. “It takes into account a variety of factors when determining adequacy, from privacy rules and regulations, through to regulator activity, government policies and practices and whether enough legal remedies exist to protect privacy rights.
“I expect this decision to be granted beyond 2021 as there’s a whole process the EU must follow to come to a final decision. In short, no-deal means that the road ahead is more complicated, lengthy and uncertain.”
Read the full article at IDG Connect.
For more information on international data transfers read our article; A Post-Schrems II World: 5 Insights for International Data Transfers.