In the current Brexit climate when the doors to Downing
Street open and close to Cabinet ministers every few minutes and many are
poised to hear the details of the deal(s), it is easy to forget that the world and
the EU wheels still turn. On 13 November a Communication
on what happens post withdrawal was published covering many areas of activity
that are of interest to tech lawyers but the guidance on personal data is
particularly worthy of being highlighted and is set out below.
Few people deluded themselves that an immediate adequacy
decision would be forthcoming but it would seem that even those few can ditch that
delusion. Perhaps the detail in that 500-page draft withdrawal agreement will
resurrect that hope.
Personal data
In the case of a no deal scenario, as of the withdrawal
date, the transfer of personal data to the United Kingdom will become subject
to the rules on international transfers in application of the General Data
Protection Regulation (EU) 2016/679, Directive (EU) 2016/680 for the law
enforcement sector and Regulation (EC) 45/200126 for the institutions and
bodies of the European Union. The General Data Protection Regulation, Directive
2016/680 and Regulation 45/2001 contain a broad toolbox for data transfers to
third countries. This includes in particular the so-called ?appropriate
safeguards’ (e.g. the Commission’s approved Standard Contractual Clauses,
Binding Corporate Rules, administrative arrangements) that can be used both by
the private sector and public authorities. In addition, the three legislative
acts mentioned above contain a number of derogations for specific situations
that allow data transfers even in the absence of appropriate safeguards, for
instance if the data subject provides explicit consent, for the performance of
a contract, for exercise of legal claims or for important reasons of public
interest. These are the same tools that are used with most countries in the
world for which no adequacy decision exists. In view of the options available
under the legislative acts mentioned, the adoption of an adequacy decision is
not part of the Commission’s contingency planning.
