The European Data Protection Board (EDPB) has published two information notes relating to data transfers and the role of the ICO if the UK leaves the EU without a deal.
The EDPB has published two guidance notes for a no-deal Brexit: one relating to data transfers and the other relating to the role of the ICO as a BCR supervisory authority if the UK leaves the EU without a deal.
If there is no agreement between the EEA and the UK (no-deal Brexit), the UK will become a third country from 00.00 am CET on 30 March 2019. This means that the transfer of personal data to the UK has to be based on one of the following “data transfer instruments” as of 30 March 2019:
The note provides information to commercial and public organisations on these data transfer instruments under the GDPR for the transfer of personal data to the UK if there is a no deal Brexit.
The EDPB builds upon the guidance provided so far by supervisory authorities and by the European Commission. EEA organisations may turn, if necessary, to the national supervisory authorities competent to oversee the related processing activities.
An organisation transferring personal information to the UK after 30 March 2019 needs to follow the following five steps:
According to the UK government, the current practice, which permits personal data to flow freely from the UK to the EEA, will continue in the event of a no-deal Brexit. To this end, the UK Government’s and the ICO’s website should be regularly consulted.
Role of ICO
If there is a no-deal Brexit and the ICO no longer has a role in the BCR community, companies are advised to consider the following:
Lead Supervisory Authorities should be identified by using the criteria set out in Working Document on the approval procedure of the Binding Corporate Rules for controllers and processors.
In any of the above scenarios, the Supervisory Authority that may be approached to act as the new BCR Lead Supervisory Authority will consider in cooperation with other concerned Supervisory Authorities whether it is the appropriate BCR Lead on a case by case basis and inform the group accordingly. For any questions or further information, groups should contact the ICO.