In a notice issued yesterday, the EU Commission makes clear that ‘in view of the considerable uncertainties, in particular concerning the content of a possible withdrawal agreement, all stakeholders processing personal data are reminded of legal repercussions, which need to be considered when the United Kingdom becomes a third country.’
‘Subject to any transitional arrangement that may be contained in a possible withdrawal agreement, as of the withdrawal date, the EU rules for transfer of personal data to third countries apply.’
The Commission states that aside from an “adequacy decision”, there are additional options under the GDPR, such as using Binding Corporate Rules, contractual clauses, codes of conduct or certification mechanisms. The Commission is working with interested parties and data protection authorities to make the best use of these new instruments.
The Commission makes no comment on the UK’s possible adequacy in this notice. The UK Data Protection Minister, Matt Hancock, (promoted on 8 January in the same Department to become the Cabinet level Secretary of State), has said that the UK aims at achieving an adequacy decision but we must wait until the Brexit negotiations have reached the point in which data protection issues are included.
Read more about this topic in Privacy Laws & Business UK Report, to be published next week. This subject will also be covered at PL&B’s 31st Annual International Conference, 2-4 July 2018 at St. John’s College, Cambridge www.privacylaws.com/annual_conference/
See the EU notice at http://ec.europa.eu/newsroom/just/document.cfm?action=display&doc_id=49245
Join PL&B GDPR Help! Roundtable: Managing Risk on 31 January 2018 in London
1. Update on the Data Protection Bill/Act relevant to GDPR implementation
2. Negotiating data processing contracts with third parties in the light of the GDPR requirements
3. Conducting Data Protection Impact Assessments
4. Data Protection by Design and Default
5. Keeping records of processing
Go to www.privacylaws.com/help for more information and e-mail email@example.com to register.