Turning off the tap: How will Brexit impact data flows?
Blog: Laurence Lawson
Brexit. It seems wherever you turn, there is no escaping the pandemonium it is causing. In the last month or so, it seems like the heat has been turned up on the entire topic and nobody, not even the British government, knows what will happen at the end of March.
With two months to go, we look at the potential avenues that can be taken by the powers that be, and the effects that this will have on data transfers to and from the British Isles; and the effect this will have on your business.
In my last blog, I discussed how we reached this situation and briefly what the GDPR itself is; if you’re in the dark, I recommend to read that to get up to speed.
The Current Trajectory
This post is being written on the 17th of January, the morning after the Prime Minister narrowly survived the vote of no confidence made against her. Things may be drastically different by the time you are reading this.
As it stands, with Theresa May’s own Brexit deal suffering the largest defeat recorded in Parliament’s history and with the EU stating that they are not willing to renegotiate, the UK is hurtling towards the no deal or ‘cliff edge’ scenario. In this timeline, the UK would essentially revert to the early 1970’s before it joined the EU; it would follow World Trade Organisation rules and, in the eyes of the EU, be a ‘third country’.
For data transfer purposes, this makes the situation very tricky. The GDPR is very clear regarding transfers to third countries; they can only be permitted under certain circumstances or using particular mechanisms. In the case of a no-deal Brexit, you will need to rely on model clauses, binding corporate rules, codes of conduct, certifications, or derogations to continue with transfers between the UK and the rest of the EU. In most cases, these mechanisms have yet to be fully tested and some can be very complicated to implement. These mechanisms require prior planning and a deep understanding as to how personal data moves within your business.
Of course, there is still time left on the clock and a cliff edge is not an inevitability. There are two other distinct possibilities as to the final result of the Brexit process.
Before these are discussed, it is worthwhile to mention that there is the potential for the UK to extend the Brexit process beyond the end of March, which seems more likely by the day. If extended, data transfers will continue unimpeded until the revised date passes. This would be good news for businesses as it offers more time to plan for the outcome.
The first possibility if action is taken is an adoption of a deal similar to the one which Theresa May lost in a remarkable manner on the 15th of January. The main rationale for this loss was to do with the relationship between Northern Ireland and the associated ‘backstop’. A renegotiated deal is the preferred avenue for the Government as it stands, despite the EU’s unwillingness to renegotiate. If a deal is renegotiated, some aspect of data transfer mechanisms could be included.
The original deal struck by Theresa May did not include such a mention, but the UK has signalled that it will seek an adequacy requirement. This could take some time, as shown by the progress made by Japan and South Korea who are currently pursuing adequacy.
Therefore, if Brexit does happen, deal or no deal, there will be a short transition period wherein the UK will be classified as a third country. Businesses should already have a plan in place for if this happens, as it is the most likely outcome.
Finally, there does remain the slim possibility of a no-Brexit. Some have speculated that the UK could either scrap Brexit completely or that there will be a second referendum which polls suggest would result in a remain win. In this case, data transfers between the UK and the European mainland can continue as they are, without any restrictions.
Regardless of what happens, you can expect changes to happen between now and March; and of course, the lasting relationship between the UK and the rest of the EU in terms of data transfers will change in any Brexit scenario.
If you have not started planning for the impact Brexit will have on your business, especially in regards to transferring data, it is not too late. The British authorities, ICO, have provided some great guidance. If you need help making these changes, or want to know more about how Brexit will affect your business, please do get in touch and we will help you out.
Laurence is a privacy professional working within the Risk Advisory practice in Finland, having moved over to Helsinki from the UK in 2016. He possesses his LL.B from the UK and has his LL.M in International Business Law, specalising in Privacy law, from the University of Helsinki.