Short Reads

Brexit and data protection: preparing for a 'no-deal'

Brexit and data protection: preparing for a 'no-deal'

Brexit and data protection: preparing for a 'no-deal'

18.02.2019 NL law

As it stands, the UK will exit the European Union at midnight on 29 March 2019. Therefore, businesses within the UK, or with trade relations with the UK, would be best advised to assume that a no-deal Brexit is inevitable. The exchange of personal data  within the EU is governed by the General Data Protection Regulation (GDPR). In a no-deal Brexit, the GDPR will cease to be applicable in the UK upon its EU exit.

The national data protection authorities, united in the European Data Protection Board (EDPB), published an 'information note' on 13 February regarding personal data transfers in the event of a no-deal Brexit. The EDPB reaffirms the importance of making adequate arrangements for data streams to and from the UK in the event that no deal is reached. In particular, it sets out the options open to safeguarding the transfer of data to the UK under the GDPR once it leaves the European Union.

Data transfers from the UK

The UK has indicated that it will incorporate the GDPR into its legal system after Brexit As a consequence, data transfers from the UK to the rest of the EU should not be affected by Brexit, and will be subjected to the same safeguards as they are now.

Data transfers to the UK

More problematic, for the time being, are transfers of personal data to the UK. The EDPB's note indicates that, in the event  of a no-deal Brexit, the UK will become a 'third country' for the purposes of the GDPR. As a result, data streams from the EU towards that country may no longer flow freely as they do between EU-members, but must be subjected to one of the 'safeguards' envisioned by the GDPR, as set out below. 

Adequacy Decision

The adequacy decision is a mechanism, by which the European Commission may declare that a non-EER country offers a sufficient level of data protection in its legal system, and that no further measures by the data controller or processor are required for data streams to the UK. An adequacy decision for the UK would enable UK data transfers after a no-deal Brexit and is the preferred option under the withdrawal agreement. However, a possible Adequacy Decision for the UK is not expected before late 2020. Therefore, a 'legislation gap' between March 29th and the expected adequacy decision is highly likely.

Binding Corporate Rules

If the data is exported within a single group of companies or an international organisation, the company group may impose what are known as Binding Corporate Rules (BCRs) on its respective entities. This is essentially a 'Code of Conduct' that brings the non-EU entities in line with the data protection standards already applicable to their EU counterparts. Companies may draft their own BCRs, but they must be approved by the data protection authority of the company's lead authority. Such approval processes  take time and are not a quick solution that can be reached before the 30 March deadline.

Standard Model Clauses

The Standard Model Clauses (SMC) is a list of data protection clauses pre-approved by the European Commission. If incorporated in the agreement with a non-EU processor or joint controller the SMC is sufficient to comply with the GDPR's provisions on data transfers outside the Union. Separate versions exists for controller-to-controller transfers (both the original version and the alternative version can be used, depending on the parties' preference), and for controller-to-processor transfers. The SMCs must be signed by both parties, and must not be amended in any way in order to be valid.

Use of the SMCs will often be the most practical option, as these do not hinge on approval from a data protection authority.

Derogations

In exceptional circumstances, the data controller may transfer data outside the EU without any of the above safeguards in place. In particular, the transfer is permitted where the data subject has given explicit consent for the transfer. This is different from the 'general' form of consent which can be used as a grounds for processing, as the data subject must be informed of the particular risks associated with the data transfer.

Codes of conduct and certification mechanisms

Lastly, companies may adhere to approved codes of conduct set out by industry-specific representative bodies or associations and approved by the EDPB. In addition, certification bodies may be created to certify and monitor companies on a voluntary basis. However, these provisions are something for the future – no code or body has acquired the required approval from the EDPB as yet. It is therefore not expected that such tools will be in place for post-Brexit data transfers very soon, though it may be useful to contact your industry association to check if they are likely to be adopted in the near future.

Team

Related news

02.10.2019 EU law
Seminar: Data protection implications of (a no-deal) Brexit

Seminar - On October 2nd at 4 pm, we organize a seminar where we will discus the implications of a (no-deal) Brexit on data protection.  These issues affect all businesses interacting between UK and EEA (including EU) and which send or receive data to and from UK. We will highlight the main challenges both in the case of a hard Brexit on 31 October 2019 and in other scenarios. We will also offer guidelines to help your organisation mitigate the respective risks.

Read more

05.09.2019 NL law
Wanted: fast solutions for fast-growing platforms

Short Reads - Dominant digital companies be warned: calls for additional tools to deal with powerful platforms in online markets are increasing. Even though the need for speed is a given in these fast-moving markets, the question of which tool is best-suited for the job remains. Different countries are focusing on different areas; the Dutch ACM wants to pre-emptively strike down potential anti-competitive conduct with ex ante measures, while the UK CMA aims for greater regulation of digital markets and a quick fix through interim orders.

Read more

06.09.2019 NL law
Supervision of crypto services

Short Reads - On 3 September 2019, De Nederlandsche Bank ("DNB") published a press release in which DNB points out to providers of crypto services that they should prepare for imminent DNB supervision. Companies facilitating the exchange of crypto currency for normal money and companies that offer crypto wallets will have to comply with a registration obligation from the beginning of 2020.

Read more

05.09.2019 NL law
No fine means no reason to appeal? Think again!

Short Reads - Whistleblowers who have had their fine reduced to zero may still have an interest in challenging an antitrust decision. The Dutch Authority for Consumers and Markets (ACM) held two de facto managers personally liable for a cartel infringement but, instead of imposing a EUR 170,000 fine, granted one of them immunity from fines in return for blowing the whistle. The Trade and Industry Appeals Tribunal found that, despite this fortuitous outcome, the whistleblower still had an interest in appealing the ACM's decision.

Read more

05.09.2019 NL law
ECJ answers preliminary questions on jurisdiction in cartel damage case 

Short Reads - On 29 July 2019, the ECJ handed down a preliminary ruling concerning jurisdiction in follow-on damages proceedings in what is termed the trucks cartel. The court clarified that Article 7(2) Brussels I Regulation should be interpreted in such a way as to allow an indirect purchaser to sue an alleged infringer of Article 101 TFEU before the courts of the place where the market prices were distorted and where the indirect purchaser claims to have suffered damage. In practice, this often means that indirect purchasers will be able to sue for damages in their home jurisdictions.

Read more

29.08.2019 NL law
Stibbe partners with the Blue Tulip Awards

Inside Stibbe - Participants in the Blue Tulip Awards can now make use of Stibbe's high-quality legal knowledge, as we have become a partner of the Blue Tulip Awards 2019 in the legal domain. We will provide legal advice on various themes start-ups which have registered for the categories ‘Mobility’ and ‘Finance’. This year's partnership follows our collaboration with last year’s edition, when the event was known as the Accenture Innovation Awards.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring