Brexit And The GDPR: What Does Brexit Mean For Your EU Business?

Brexit will change almost every core function for EU companies that do business with the UK: from trade to regulation, hiring and transport, there’s almost nothing that goes untouched by the withdrawal of the UK from the EU and the single market. Data protection is unlikely to be at the forefront of companies’ minds during this period, but there are real issues facing data controllers and processors thanks to the GDPR.

During the transition period (i.e. until 31 December 2020), the GDPR continues to apply to the UK. However, the relationship between the GDPR and Brexit beginning in 2021 is unsettled. The UK is no longer a ‘Member State’ and will be considered as a “third country” for GDPR purposes as from 1 January 2021. It will therefore need to negotiate adequacy status with the EU. What this entails and how long it will take is largely up in the air, as both parties must agree on a solution. Until then, data transfers from the EU to the UK will become infinitely more complicated.

Here’s what you need to know about the GDPR and Brexit if you’re an EU company and you offer products or services to individuals who are in the UK or if you monitor the behaviour of such individuals !

Will Companies Be Able to Send Data Between the EU and the UK?

At present, the UK government does not intend to consider the EU as a third country in terms of UK data processing. As a result, UK companies will be able to continue sending data to the EU. However, the EU has not reciprocated this commitment, which means that EU data transfers to the UK will face restrictions.

The results are likely to be messy. UK-based organisations will struggle to serve customers within the EU. It will also present unique challenges on the island of Ireland as well as for Gibraltar/Spain, where ties with the EU are intimate.

Lifting the restrictions will depend on the UK and each relevant company meeting the EU’s safeguards for supporting data transfers. The requirements for third country data transfers are detailed in Chapter V of the GDPR.

The UK: A Safe Place for Data Post-Brexit?

The GDPR requires that data transfers to any third country occur only with countries designated as ‘adequate’ by the European Commission.

Countries with adequacy are those that use an EU-equivalent level of data protection. As a result, they aren’t bound by Article 46 and 47 of the GDPR, and data can flow between the EU and these countries without limits or checks. At present, countries recognized as being adequate for data transfers include Andorra, Argentina, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, and Uruguay.

Canada and Japan are also included, but there are limitations to data transfers to these countries. In Canada, only commercial organisations benefit. In Japan, the adequacy decision only covers private sector organisations.

The U.S. was also included via the US-EU Privacy Shield – but only for U.S. companies that signed up to the framework – but this mechanism was recently invalidated by the Court of Justice of the EU, meaning that data transfers between the EU and the US are no longer considered as safe or protected, unless appropriate safeguards are put in place and if the rights of individuals are enforceable, and effective legal remedies are available.

What comes next for the UK will depend on any data protection agreements worked out in the transition period. The UK already uses the Data Protection Act 2018, which issued requirements similar to the GDPR in terms of privacy and transparency.

However, the most comprehensive understanding of what will be the UK version of the GDPR can currently be found in the Data Protection, Privacy and Electronic Communications (EU Exit) Regulations 2019.

When Will the Data Transfer Rules Change?

The Withdrawal Agreement acknowledged by the EU and the UK government stipulated a transition period to last from January 31, 2020 to December 31, 2020. During this period, the UK agreed to continue following EU laws and regulations – including the GDPR – despite the ‘exit’ taking place in January. As from 1 January, 2021, the UK will become a third country.

As a result, data transfers continue as normal for both EU and UK companies and residents for the duration of 2020, until the end of the transition period.

However, there will not be a clean break. Any EU-originating data in the UK prior to the end of the transition period will still benefit from the GDPR as written and amended by the EU. The product is a backstop that continues to protect the privacy of individuals in the EU regardless of the outcome of negotiations for 2021 and beyond.

Don’t Forget This Specific Obligation!

If your EU company doesn’t have an establishment in the UK and you offer products or services to individuals who are in the Uk or if you monitor their behaviour, then you will most likely have to appoint a UK data protection representative. 

The UK’s data protection authority (ICO) confirms that “the UK government intends that after the transition period ends, the UK version of the GDPR will say that a controller or processor located outside the UK – but which must still comply with the UK GDPR – must appoint a UK representative.”

A UK data protection representative is NOT a Data Protection Officer (DPO). Instead, a UK representative is a natural person or body within the UK who is your point of contact for individuals in the UK, as well as for the regulator.

To be compliant with the UK GDPR, you will need a data protection representative in place by the end of the transition period (i.e. as from 1 January, 2021).

Click here to know more.