Brexit implications for data protection

Transitional period

The draft withdrawal agreement suggests there will be a transitional period from when the UK leaves the EU until 31 December 2020. At that point, it is envisioned the protection of personal data will become “essentially equivalent” to that of EU law.

“It looks like there will be business as usual during the transitional period, and by the end of which some other basis for data sharing could be in place, such as an adequacy decision,” says Anthony Lee, data protection expert and partner at DMH Stallard.

“The withdrawal agreement also talks about ‘essentially equivalence’ to give the European Commission the flexibility to grant adequacy status even if there are some differences between the laws of the country in question and the GDPR.

“In this regard, the GDPR allows member states to introduce local rules in a number of areas (known as derogations) and the UK Data Protection Act 2018, which brings in the GDPR, has taken advantage of this.

“Under the essential equivalence principle, I would hope that the differences which are inherent in the derogations would not be fatal to an adequacy assessment,” he says.

Adequacy assessment

The optimal solution would be that, as part of the negotiations, the UK gains an adequacy assessment before the conclusion of the transition period. This would mean data sharing between EU and UK organisations would continue as before and require no further contractual or legislative measures to be undertaken. Countries that have gained an adequacy assessment include Argentina, Israel and New Zealand.

Article 45 of GDPR states that: “A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.”

Currently, an adequacy assessment can take place only when a country is classed as a third country. Thus, for the UK to gain an adequacy assessment, it would first need to leave the EU, although this could be incorporated into the transition phase.

In the UK’s favour is that the GDPR has been enshrined into UK law, as part of the Data Protection Act 2018, thus the UK already meets many of the legislative requirements for the adequacy assessment.

“Our argument is that we have implemented the regulation lock, stock and barrel, by dint of the Data Protection Act 2018,” says Lee. “If our data protection laws are considered sufficiently robust as to give us the adequacy status, we would be on the same basis as other approved countries, such as Argentina.”

Adequacy assessment

An adequacy assessment takes into account the country’s rules of law, the existence and effectiveness of the independent advisory authorities, and other relevant legislation. It is this latter aspect that may prove a potential hurdle for the UK.

The Investigatory Powers Act 2016 (IPA) replaced the Regulation of Investigatory Powers Act 2000 (Ripa) after the latter was deemed unlawful under EU law.

However, a subsequent high court case brought by Liberty concluded some aspects of the IPA were also unlawful and that these issues would need to be addressed by 1 November 2018. Lord Justice Singh concluded the hearing, stating: “Part 4 of the Investigatory Powers Act 2016 is incompatible with fundamental rights in EU law.”

It has been posited that an adequacy assessment could require a softening of the IPA before the adequacy status is granted.

“My personal view is that we may well have a strong hand in being able to achieve adequacy status by having a well-regarded Information Commissioner’s Office and implementing the regulation, but I think the Investigatory Powers Act will be the sting in the tail,” says Lee.

Privacy shield

An alternative solution could be a regulatory framework for exchanges of personal data between the EU and the UK, similar to the EU-US Privacy Shield. This has allowed EU countries to freely share data with the US, without an adequacy assessment taking place.

“If we do not achieve full adequacy status after we become a third country,” says Lee, “a middle ground might be that we negotiate an equivalent to the Privacy Shield that the United States has with Europe.”

This would not be an ideal solution, as there are concerns as to the legality of this framework. The previous version of Privacy Shield, the International Safe Harbour Privacy Principles, was declared invalid by the European Court of Justice in the Max Schrems versus Data Protection Commissioner case in 2015.

The subsequent Privacy Shield should provide a stricter set of ground rules, but points criticised by the court during the Schrems ruling persist in this new arrangement, which is currently under scrutiny by the European Data Protection Authorities.

Furthermore, such a regulatory framework for data sharing would first need to be put in place. At the time of writing, there has been no indication of any such legislative measures being prepared.

Model clauses

In the worst-case scenario, the UK would crash out of the EU with no deal, not meet the requirements for an adequacy assessment for data sharing and not have a regulatory framework in place for the purposes of sharing data. Were this to happen, then organisations in EU countries would no longer be able to share data with organisations in the UK, without specific contracts.

Data sharing contracts incorporating model clauses would need to be enacted for each and every type of data sharing. Model clauses stipulate the expected requirements for sharing data outside of the EU.

“Model clauses, which are approved by the European Commission, are one of the ways to overcome the adequacy requirements,” says Lee.

“Model clauses are quite detailed, but Article 28 of the GDPR also stipulates that if you are going to appoint a third party to process data then you need to have, in the contract between the data controller and the data processor, a bunch of additional clauses that were not mandatory under the old regime.”

The current model contracts are based on the EU’s previous data protection regime. They are still used for exporting data outside of the EU economic area, as they have not yet been updated.  They also do not currently incorporate GDPR. New model clauses are currently being written to incorporate GDPR requirements.

Binding corporate rules

Large multinational companies can also utilise binding corporate rules for internal data transfers. Such rules are similar to a code of conduct. They are especially useful for allowing the transfer of personal data internationally, within the same corporate group, to countries that do not otherwise provide an adequate level of protection.

Such binding corporate rules must ensure all data transfers within a corporate group are safe. These rules must address the following requirements:

• Privacy principles, such as transparency, data quality and security;
• Tools of effectiveness (such as audit, training, or complaint handling systems);
• Proof that the rules are binding.

However, binding corporate rules take far longer to put into place than a data sharing contract between a data controller and a data processor, and do not cover data sharing with external organisations.

Hope for the best, prepare for the worst

The draft withdrawal agreement gives some indication of what will happen when the UK leaves the EU, provided that the UK Parliament agrees. Once the UK leaves the EU, it will enter a transition period for 21 months, at which point an “essentially equivalent” system for data protection should be in place.

This is by no means a certainty, given the recent parliamentary resignations. Should the UK Parliament vote against the agreement, the UK could well leave the EU without a deal in place. “A no-deal Brexit will probably mean that we have not got an adequacy status,” says Lee.

“The chances are we would be a third country, in the position of India, until such time as we can get adequacy status, or, failing that, some kind of Privacy Shield arrangement is put in place.”

This uncertainty presents a unique challenge for UK organisations, especially small to medium-sized enterprises that typically have tighter budget and resource constraints than larger companies.

Until further direction is given by the government indicating the shape of the UK’s data sharing agreement with the EU, organisations should keep abreast of the situation and have plans in place for each eventuality.

“You need to have a plan, as well as a Plan B, and even a Plan C, for if we crash out of the EU, do not have adequacy status and do not have a Privacy Shield equivalent in place,” says Lee. “It will not stop the business, but it will be more difficult.”