Brexit creates questions over privacy rules

On 23 June 2016, the UK held a referendum to decide whether or not to remain a member of the European Union, which resulted in a win for the “Leave” camp. The referendum is not legally binding for the British government. However, since most people consider it politically binding it is therefore more than likely that the UK will leave the European Union in the course of the next few years.

If the UK were to leave the European Union, it would most likely put in place a legal framework that reflects the provisions of the GDPR. In order for the UK to continue to trade with the EU and Switzerland on equal terms, the UK Information Commissioner’s Office (ICO) confirmed that it would seek recognition as an adequate jurisdiction. This would entail that the UK, similar to the Swiss model, would adopt data protection standards equivalent to the GDPR, which would allow for a continued free flow of personal data between the EU and the UK.

Much will depend on the model the UK and the rest of the EU negotiate for UK’s relationship with the remaining EU member states. Should the UK decide to exit the EU, it needs to follow the formal legal procedure set out in Article 50 of the Treaty of the European Union. This procedure takes a minimum of two years, which means that companies still need to prepare for the entry into force of the GDPR on 25 May 2018.

From a Swiss – UK data protection perspective, there is no need for any rushed decisions. The GDPR will officially come into force 28 May 2018, and thus apply in the UK prior to the formal exit from the European Union. There are some concerns that an eventual “Brexit” might disrupt the data flow for international businesses. Special instruments for Swiss and other third country transfers may need to be introduced as mitigating measures with regard to data transfers in and from the UK. For cloud, digital or finance-based services in Switzerland that use a variety of providers in the UK, this might result in a substantial need for adjustments of their processes and contractual arrangements. Companies may, for example, consider to focus on Brexit through the definition of standard contractual clauses, binding corporate rules or the choice of service providers within an EU member state.