No deal Brexit means no data adequacy decision

On 13th November 2018 the European Commission announced that making an adequacy decision in the UK’s favour (i.e. making an official ruling that the UK’s data protection laws were adequate for it to be permitted full rights to continue processing and transferring data covered by GDPR) is not part of contingency planning in the event of a “No Deal” Brexit.

In that event, businesses will need to rely on alternative bases for transferring data from the EU to the UK unless and until full UK adequacy is confirmed. The Commission argues that there is already what it describes as a “broad toolbox for data transfers to third countries” within GDPR that businesses may use, even in the absence of certain safeguards (e.g. if the data subject gives explicit consent, or for important reasons of public interest), and, as the planning is for a situation that would be expected to be temporary in any case, no immediate adequacy decision is deemed necessary.

It should, therefore, be part of all businesses’ planning to look now at what their options will be to remain GDPR compliant in every Brexit scenario, but especially in the event of “No Deal”.