Brexit: Personal Data Transfers
September 2020Companies need to be aware if they are transferring data to the U.K. that steps need to be taken before the 31st of December to ensure an appropriate legal basis for transfers of data are in place.Given how much has happened in 2020 especially with Covid-19, you could be forgiven for forgetting about the impending impact of Brexit. Last month, the European Commission published a notice to stakeholders providing an update on personal data transfers after the end of the Brexit transition period on 31 December 2020.
The Notice seeks to keep interested parties informed on the legal considerations concerning transfers of personal data from the EU to the UK after the Brexit Transition Period. After the end of the transition period, any transfer of personal data to the United Kingdom other than that governed by Article 71(1) of the Withdrawal Agreement will not be treated as sharing of data within the Union.
It will need to comply with the relevant Union rules applicable to transfers of personal data to third countries. The European General Data Protection Regulation ("GDPR") prohibits the transfer of personal data from the EEA to non-EEA countries unless certain specific safeguards (contained in Chapter 5 of the GDPR) are applied as the appropriate basis for any transfer.
Such appropriate safeguards include, for example the use of Standard data protection contractual clauses or Binding corporate rules.
Those seeking to transfer personal data from the EEA to the UK after the Brexit Transition Period will need to consider their proposed data flows and understand the basis on which they will seek to validate such transfers.
To view the notice in question click
HEREBy Judy de Castro
Regulatory Consultant