Brexit, Data Flows and the Standard Contractual Clauses.

Author:Goldthorpe, Helen

While much of the attention around Brexit negotiations has focused on the movement of physical goods, it is also important to consider the impact of the pending Brexit on data flows between the UK and the EU.

Under EU regulations, there are restrictions on the transfer of personal data outside the European Economic Area (EEA). In contrast, transfers within the EEA borders are not restricted which allows UK companies to transfer data freely within that area. In the event of the UK leaving the EU in a no-deal Brexit scenario, or likewise without any transitional arrangements in place, transfers between the UK and the EEA would be subject to the same additional regulations as those which currently apply to non-EEA transfers.

This, of course, has implications for any businesses that rely on transferring UK-hosted data to the EEA and vice versa, for example, multi-national groups. Due to the advent of cloud computing, it is not common for personal data hosted to be stored on servers situated in other EU countries, so this would need to be reviewed by firms in the event of a no-deal situation.

The position for businesses trying to plan ahead for a no-deal Brexit is also complicated by a case which is currently being heard in the European Courts. Those with long memories may be familiar with the name Max Schrems. In 2015, he challenged the way in which Facebook transfers personal data to the USA and successfully invalidated Safe Harbor, which was a mechanism that enabled such transfers. As a result, many businesses changed to another permitted mechanism, known as Standard Contractual Clauses (SCC) while waiting for what is known as 'Privacy Shield' to be implemented.

In turn. Max Schrems started legal action challenging the use of the SCC by Facebook. It is this litigation that is currently being heard in the European courts, with a judgment expected after the summer. This is particularly significant for businesses in the UK, as the SCC are one of the main mechanisms by which data transfers from the EEA to the UK would be permitted in the event of a no-deal Brexit. If the SCC are invalidated, then it will leave businesses in a difficult position with no obvious replacement.

The position in relation to outbound transfers after Brexit is likely to be more straightforward--the UK government...

To continue reading