UK is a 3rd country for data transfers from 30 March 2019
In a notice issued yesterday, the EU Commission makes clear that ‘in view of the considerable uncertainties, in particular concerning the content of a possible withdrawal agreement, all stakeholders processing personal data are reminded of legal repercussions, which need to be considered when the United Kingdom becomes a third country.’
‘Subject to any transitional arrangement that may be contained in a possible withdrawal agreement, as of the withdrawal date, the EU rules for transfer of personal data to third countries apply.’
The Commission states that aside from an "adequacy decision", there are additional options under the GDPR, such as using Binding Corporate Rules, contractual clauses, codes of conduct or certification mechanisms. The Commission is working with interested parties and data protection authorities to make the best use of these new instruments.
The Commission makes no comment on the UK’s possible adequacy in this notice. The UK Data Protection Minister, Matt Hancock, (promoted on 8 January in the same Department to become the Cabinet level Secretary of State), has said that the UK aims at achieving an adequacy decision but we must wait until the Brexit negotiations have reached the point in which data protection issues are included.
Read more about this topic in Privacy Laws & Business UK Report, to be published next week. This subject will also be covered at PL&B’s 31st Annual International Conference, 2-4 July 2018 at St. John’s College, Cambridge.
See the EU notice at http://ec.europa.eu/newsroom/just/document.cfm?action=display&doc_id=49245