EU membership secures the free movement of personal data between the EU member countries and EFTA/EEA countries. Transferring data outside the European Economic Area is allowed only if adequate level of data protection is guaranteed in the third country or additional safeguards in accordance with the GDPR are followed in the transfer of personal data. If the UK withdraws from the EU without a withdrawal agreement, the transfer mechanisms in chapter five of the GDPR are applied.
Here are the concrete steps, with which you can prepare for the arrival of Brexit:
1. Option 1. The UK withdraws from the EU March 29th, 2019 without a withdrawal agreement
If the transfer continues after March 29th, consider a suitable mechanism of transfer for your company. If needed, consult Fondia’s experts. In principle, we recommend using the European Commission’s standard contractual clauses.
2. Option 2. Withdrawal agreement is entered into force by March 29th, 2019
If the agreement is reached by March 29th, a transition period begins. EU legislation (including the GDPR) is applicable law until the end of the transition period i.e. until December 31st, 2020. Personal data can be transferred to the UK safely during the transition period
After the transition period, EU legislation is not applied. In this case it is possible that the European Commission decides on the adequate level of data protection in the UK by the end of the transition period, in which case the transfer of personal data to the UK is secured. The schedule on behalf of the Commission is unclear and we have experience that the decision-making stretches. For example, for Israel the decision-making process took 42 months. For this reason, companies should prepare for applying other safeguards, such as the Commission’s standard contractual clauses.
The UK has prepared excellently for the arrival of Brexit with regard to the GDPR and transferring personal data. The UK is one of the few member countries, which got their own national Data Protection Act into effect simultaneously with the GDPR in May 2018.
Moreover, even if the withdrawal agreement is not achieved, the Commission’s adequacy decision may come into effect later on. We do not recommend reckoning on the possible decision-making, since the decision-making process can stretch and there is no information on the schedule at this point.