Brexit And Cross-Border Personal Data Transfers: Agree A New Basis Now!

With 6 months to go, the UK government has warned UK firms to assume that their trading partners in the European Economic Area will be unable to send them any personal data from 29 March 2019, unless they enter into formal written agreements generally required for sending data to non-EEA countries or some other basis for transfer listed below. 

It's likely that EEA trading partners may be waiting on UK firms to do the necessary work, so the government recommends that UK firms should be proactive in making contact on this issue. 

However, any agreements would need to be under the law of an EEA member state (so I would likely advise on this area via my consultancy with Leman in Ireland, rather than via Keystone Law in the UK).

 

The UK proposes to allow the free flow of personal data from the UK to the EU27, but does not mention Norway, Liechtenstein or Iceland in relation to that proposal.

The EU can make an "adequacy decision" which allows the free flow of personal data to a non-EU country where that country's level of personal data protection is essentially equivalent to that of the EU. But the process for reaching such a decision - and even agreeing a timetable for that process - could not begin until after Brexit.

Aside from having the explicit consent of the individuals concerned (or perhaps relying on one of the processing rights under the General Data Protection Regulation), alternative ways for EEA firms to make personal data transfers to UK firms are as follows:

1. A legally binding and enforceable instrument between public authorities or bodies;
2. Binding corporate rules;
3. Standard model data protection clauses adopted by the Commission;
4. Standard data protection clauses adopted by an EEA supervisory authority and approved by the Commission;
5. An code of conduct approved by an EEA supervisory authority, together with binding and enforceable commitments of the receiver outside the EEA;
6. Certification under an approved EEA certification mechanism together with binding and enforceable commitments of the receiver outside the EEA;
7. Contractual clauses authorised by an EEA supervisory authority
8. Administrative arrangements between public authorities or bodies which include enforceable and effective rights for the individuals whose personal data is transferred, and which have been authorised by an EEA supervisory authority.