The various EU bodies have issued a ‘Communication’, Preparing for the withdrawal of the United Kingdom from the European Union on 30 March 2019: a Contingency Action Plan, which inter alia covers personal data
In the current Brexit climate when the doors to Downing Street open and close to Cabinet ministers every few minutes and many are poised to hear the details of the deal(s), it is easy to forget that the world and the EU wheels still turn. On 13 November a Communication on what happens post withdrawal was published covering many areas of activity that are of interest to tech lawyers but the guidance on personal data is particularly worthy of being highlighted and is set out below.
Few people deluded themselves that an immediate adequacy decision would be forthcoming but it would seem that even those few can ditch that delusion. Perhaps the detail in that 500-page draft withdrawal agreement will resurrect that hope.
In the case of a no deal scenario, as of the withdrawal date, the transfer of personal data to the United Kingdom will become subject to the rules on international transfers in application of the General Data Protection Regulation (EU) 2016/679, Directive (EU) 2016/680 for the law enforcement sector and Regulation (EC) 45/200126 for the institutions and bodies of the European Union. The General Data Protection Regulation, Directive 2016/680 and Regulation 45/2001 contain a broad toolbox for data transfers to third countries. This includes in particular the so-called ?appropriate safeguards' (e.g. the Commission's approved Standard Contractual Clauses, Binding Corporate Rules, administrative arrangements) that can be used both by the private sector and public authorities. In addition, the three legislative acts mentioned above contain a number of derogations for specific situations that allow data transfers even in the absence of appropriate safeguards, for instance if the data subject provides explicit consent, for the performance of a contract, for exercise of legal claims or for important reasons of public interest. These are the same tools that are used with most countries in the world for which no adequacy decision exists. In view of the options available under the legislative acts mentioned, the adoption of an adequacy decision is not part of the Commission's contingency planning.