GDPR, data protection, Brexit and Exit Day – no changes…yet

Before Christmas there was a lot of talk about preparing for a no deal Brexit.

For data protection the implications of a no deal Brexit are significant – data has been described as the new oil, indeed the new currency of the digital economy.  The free flow of data internationally especially in areas such as the services sector underpins much UK economic activity.  A hard Brexit with no deal as regards data flows between the UK and the EU would throw a huge spanner in the works of our interconnected economy.  Yes there are potential ways around this (the use of model clauses and binding corporate rules for example) but none are as seamless or as cheap as our current situation where the UK is part of a club of nations – the EU – who operate under the same data protection rules and treat each country’s data protection laws as adequate.

Now that the UK is leaving the EU on Exit Day – 11pm Friday 31 January – with a withdrawal agreement with the EU in place a hard Brexit is avoided – at least for now.  The current GDPR regime will remain in place until the end of the transition period so no change for UK businesses at present.  What we don’t know yet is what will happen at the end of the transition period at 11pm on 31 December 2020.  The Political Declaration linked to the Withdrawal Agreement commits the EU as a priority and where possible by the end of 2020 to adopt an adequacy decision treating the UK’s data protection as adequate under EU law.  But whether this will indeed be possible is uncertain – the EU will have to assess the UK’s current data protection regime in the same way as any other “third country” applying for such a decision.  This typically takes a lot longer than 11 months.  In the past EU officials have said an adequacy decision could take years.  It is to be hoped the political will to do so expressed in the Political Declaration will speed things up.

What does this all mean for business?  As noted earlier nothing at present.  By the middle of this year the progress or not towards an adequacy decision and the overall shape of the UK’s post Brexit relationship with the EU ought to be clearer and businesses should plan on the basis of that.  If the position remains murky businesses will need to blow the dust off any no deal Brexit plans from last year and review afresh – from 11pm on 31 January the clock starts ticking again and a hard Brexit still can’t be ruled out.

Contact our experts for legal advice surrounding GDPR, data protection and Brexit.