Brexit and data transfers to and from the EEA

Data transfers to and from the EEA post Brexit have been a concern for some time. The UK has requested an adequacy decision from the EU, however such an adequacy decision relates to third countries (in relation to the EU), and therefore it seems likely that we will have to wait for the EU to issue their decision once the UK has formally ‘Brexited’ and is a ‘third country’.

The UK should obtain such an adequacy ruling, which will allow personal data transfers to continue between the EEA and the UK based on the existing arrangements (requiring data processing agreements, but not additional standard contractual clauses or binding corporate rules).

However, if no such ruling is given and the UK becomes just another ’third country’ outside the EEA, how can the data flow continue between the EEA and the UK? The answer depends on which way the personal data will flow. From the UK’s perspective (at the time of writing), personal data can continue to be transferred from the UK to an EEA state, as the UK acknowledges that the GDPR 2016/679 will satisfy the requirements of the Data Protection Act 2018.

Personal data transferring from the EEA to the UK as a third country will have to be transferred under one of the additional measures to safeguard the security of the data. In practice, based on the current laws in place in the UK, this requires the data controller involved to rely on the Standard Contractual Clauses or to put in place Binding Corporate Rules between the international companies in its own group.

This situation may become more complicated if the recent news relating to the new development of UK national data strategy and “pro-tech” plans are to be believed. The plans are said to deregulate (personal) data to allow it to flow uninhibited – much more in line with the current US policy. However, the EU have, in response, restated concerns over any potential use of (personal) data by the UK intelligence services and the potential “onward flow” to countries such as the US in the light of a recent ruling by the European court of justice which we covered here.  This most recent development seems to support the suggestion that the UK will have to wait until after Brexit for an adequacy ruling, as EU confidence is wavering. The UK’s choice of regime after Brexit could have a considerable impact on future data transfers to the EU.