Brexit and UK-US data transfers: What’s the plan?
Despite the overall political uncertainty about Brexit, worries about a sudden stop to personal data transfers from the UK to the US are misplaced, deal or no deal. There is, in fact, a plan, and it’s a reasonable, practical plan.
The UK government plans to use its regulatory powers to ensure that prior arrangements between UK data exporters and data importers in other countries continue uninterrupted. That includes recognizing existing Standard Contractual Clauses between UK data exporters and non-UK data importers. The UK government will also recognize the EU Commission’s Adequacy Decisions, including the decision regarding Privacy Shield. So US companies that import personal data from UK companies under the Standard Contractual Clauses or Privacy Shield don’t need to do anything.
What about personal data transfers between organizations in the UK and those in the EU? The UK has already adopted the GDPR into its national laws by way of the Data Protection Act 2018. The UK government will recognize the EEA countries (which includes the EU-27) as providing adequate protections, so UK data exporters can send UK personal data freely to the EU. The rules on the reverse data flows (EEA to UK), are outside of the UK government’s control, of course. The EU has signaled that it will not grant the UK an Adequacy Decision automatically, despite the extremely close alignment of the UK’s Data Protection Act 2018 and the GDPR. Accordingly, the UK government has advised UK data importers to execute SCCs with EEA data exporters. It’s worth noting that the EU’s go-slow position on granting an Adequacy Decision to the UK imposes an equal burden on EU businesses that want to export personal data to the UK and the UK businesses that want to import it.
See the UK Government’s guidance on Brexit and data transfers here. Section 2 addresses a no-deal scenario. As of the date of this blog post, the guidance was last updated on Feb. 13, 2019, so it does not reflect the EU’s agreed extension of a “No Withdrawal Agreement” exit date to April 12, 2019, or a “With Withdrawal Agreement” exit date to May 22, 2019.