August 30, 2017
One of the many uncertainties arising from Brexit is the question of what will happen to data flows between the UK and the EU.
Article 44 of the GDPR prohibits the transfer of personal data outside of the EU, which would prohibit the flow of personal data from the EU to the UK and have a huge impact on both European and British businesses.
There are exceptions to Article 44, namely Article 45 which states that the European Commission can issue an ‘adequacy decision’ (a system already in place) which allows the transfer of personal data to a third country where the Commission determines that that country’s data protection laws are of a similar standard to Europe. A number of countries have already obtained ‘adequacy decisions’ (including Canada, Switzerland and Israel). We previously predicted that the best solution for the UK in respect of receiving personal data from the EU post-Brexit would be to obtain its own ‘adequacy decision’ – the UK Government seems to agree and has recently published a paper proposing exactly this.
We will now have to wait and see if Europe accepts the arguments put forward by the Department for Exiting the European Union: a likely outcome in the opinion of this author.