On Tuesday 9 January, the European Commission published a Notice To Stakeholders about the potential implications of Brexit for EU data protection law. This is the first time that the European Union has made a statement on the adequacy decision and what the alternatives might be for the UK.
In response, Stewart Room (data protection lead partner at PwC) has moved to reassure UK organisations that, even if this adequacy decision isn’t given, there are plenty of other opportunities open to them.
“The Notice To Stakeholders confirms that, after Brexit, the UK will become a ‘third country’ for the purposes of EU law, which will potentially impact personal data exports from the EU to the UK,” stated Room. “It also confirms that, as a third country, the UK’s ‘adequacy’ for EU data protection law purposes is a matter for decision by the European Commission, rather than a status that occurs automatically.”
Room continued: “However, it does provide considerable comfort around the fact that data exports need not be unnecessarily interrupted if an adequacy decision isn’t granted, because the law contains a series of other mechanisms for organisations to rely upon to keep data flowing. These other options may not be as ‘frictionless’ as an adequacy decision, but many organisations in the UK will be very familiar with how they work, because they use them already to transfer personal data from the UK to other third countries. These include consent and contractual necessity using European model clauses or Binding Corporate Rules.”