February 18, 2019

In the absence of an agreement between the EEA and the UK, the UK will become a third country from 00.00 am CET on 30 March 2019. This means that the transfer of personal data to the UK has to be based on one of the following instruments1 as of 30 March 2019:

• Standard or ad hoc Data Protection Clauses;
• Binding Corporate Rules;
• Codes of Conduct and Certification Mechanisms;
• Derogations (which can only be used in the absence of Standard Data Protection Clauses or other alternative appropriate safeguards).

The note then provides further information to commercial and public organisations on each transfer instrument.

The note builds upon the guidance already provided by supervisory authorities and by the European Commission. EEA organisations should turn, if necessary, to the national supervisory authorities competent to oversee their related processing activities.

As for data transfers from the UK to the EEA, the note states that according to the UK Government, the current practice, which permits personal data to flow freely from the UK to the EEA, will continue in the event of a “no deal” Brexit.

The note also sets out five steps that organisations should take to prepare for a no-deal Brexit when transferring data to the UK. Organisations should:

• identify what processing activities will involve a personal data transfer to the UK;
• determine the appropriate data transfer instrument for the situation;
• implement the chosen data transfer instrument to be ready for 30 March 2019;
• indicate in internal documentation that transfers will be made to the UK; and
• update the privacy notice accordingly to inform individuals.

To access the full note, click here.