EDPB advises on Brexit implications for data transfers and BCRs



In the event of a no-deal Brexit, the UK ICO would no longer be able to approve BCRs in cooperation with the other EU DPAs. The European Data Protection Board (EDPB) advises that current BCR holders need to identify the new BCR Lead Supervisory Authority. Organisations wishing to make a BCR application, if headquartered in the UK, need to identify the most appropriate BCR Lead Supervisory Authority in an EU Member State.

Companies whose BCRs are at the review stage by the ICO also need to identify a new BCR Lead Supervisory Authority. The new BCR Lead Supervisory Authority will take over the application and formally initiate a new procedure at the time of a no deal Brexit.

If a draft ICO decision for approving BCRs is pending before the EDPB at the time of a no-deal Brexit, the company needs to identify a new BCR Lead Supervisory Authority.

With regards to international data transfers from the EEA to the UK, the Board lists all the available mechanisms, such as standard contractual clauses. According to the UK government, data transfers from the UK to the EEA will continue uninterrupted in the event of a no-deal Brexit.

See: