Take Action Now If Data Is Important To Your Business

A leading data protection lawyer is warning businesses in relation to the recently agreed Brexit trade deal - highlighting that they shouldn’t relax as there are many challenges still to overcome.

One of the key announcements in relation to data from the Trade and Cooperation Agreement (TCA) was the news of a “bridging period” of up to six months which allows personal data to continue to be sent to the UK.  This allows the European Commission time to conclude its adequacy assessment of the UK. Without this bridging period, EEA-UK data transfers would otherwise have been restricted and organisations would have had to put in place additional safeguards at the end of the Brexit transition period.

The bridging period is subject to two main conditions. The UK must not make any changes to its data protection law and the UK data protection regulator must not approve new transfer mechanisms or Codes of Conduct, without the consent of the EU-UK Partnership Council.

Despite this development, specialist lawyers at Irwin Mitchell say there are many issues to consider and that if personal data is important to a business, it must focus now on its long term data protection arrangements.

Expert Opinion

“The summary document issued by the UK Government paints a very rosy view of the TCA in relation to data and I think the reality is quite different.

“Whilst the data export issue is sorted for the next six months, If adequacy is not agreed in the next six months, then the whole export issue comes back into play and, in fact, the ICO has issued a comment that UK businesses should prepare for there being no adequacy by putting in place standard contractual clauses over the next few months.

“The TCA also only solves part of the problem from a data protection point of view as there are other requirements that UK businesses need to think about which remain an issue. These include whether a representative is needed, updating documentation including policies, privacy notices, DPIAs, loss of the one stop shop and double jeopardy regarding fines.

“It should also be borne in mind that even if adequacy is granted it is likely that it will be challenged in the EU Court – privacy campaigners have already said this is what they will do.

“I don’t think this is the end of the Brexit and data protection issues, but the TCA buys time in the short term.”
Joanne Bone - Partner

Irwin Mitchell is holding a webinar on 27 January to discuss how to prepare for transitional and unresolved issues relating to GDPR and data protection from the Brexit trade agreement.