Brexit Update: The Effect Of Brexit On Data Transfers Between The United Kingdom And The European Union

Author:Mr Claus Farber
Profession:McDermott Will & Emery
 
FREE EXCERPT

Summary

With the United Kingdom having voted to leave the European Union (Brexit) on 23 June 2016, the free flow of personal data between the United Kingdom and EU and European Economic Area (EEA) countries is at risk. Should the United Kingdom also leave the EEA and thus become a third country for the purposes of data transfers, EU/EEA businesses that are currently retaining UK service providers or data centres to handle or store personal data, or are planning to do so, would have to carefully re-evaluate this decision.

In Depth

With the United Kingdom having voted to leave the European Union (Brexit) on 23 June 2016, the free flow of personal data between the United Kingdom and the EU and European Economic Area (EEA) countries is at risk. Should the United Kingdom also leave the EEA and thus become a third country for the purposes of data transfers, EU/EEA businesses that are currently retaining UK service providers or data centres to handle or store personal data, or are planning to do so, would have to carefully re-evaluate this decision.

While Brexit will likely have the biggest impact on the financial sector, it will also affect businesses in the United Kingdom that rely on the free flow of personal data to and from EU nations. This is not only the case for businesses engaging in some sort of data processing, such as cloud service providers, outsourcing service providers or data centre operators, but may also apply to the handling of personal data within a group that has branches in both the United Kingdom and EU/EEA countries.

The actual consequences of Brexit will, of course, depend on the status that the United Kingdom will have after it leaves the European Union.

Scenario 1: The United Kingdom Remains Part of The EEA

If the United Kingdom remains in the European Economic Area, opting for the same status as Iceland, Norway and Liechtenstein, not much would change in relation to data protection.

Both the current Directive 95/46/EC and the future Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) are (or will be) annexed to the EEA Agreement, and would therefore also apply in the United Kingdom. For the purposes of data protection laws, the United Kingdom would continue to be considered part of the "Union" and could thus benefit from the free flow of data within the European Union/European Economic Area.

There is a possibility that European businesses looking for a third-party provider to handle or store their...

To continue reading

REQUEST YOUR TRIAL