Brexit and data protection adequacy
Following Brexit on 31 January 2020 and the expiry of the transition period on 31 December 2020 and unless any other relevant arrangement is concluded between the UK and the EU in the meantime, the UK will be treated as a third country for EU personal data protection purposes. This means that transfers of personal data can generally only be made without the clear and informed consent of the parties from the EU to the UK if the UK has arrangements in place to ensure an "adequate" level of protection for such personal data in the UK or if other appropriate safeguards are in place to ensure the protection of such personal data.
The non-binding UK-EU Political Declaration finalised in October 2019 commits the parties to taking steps in the transition period towards ensuring that "adequacy" assessments have been completed before the end of the transition period. (There are reciprocal commitments which place an onus on the UK to take steps towards ensuring that their own "adequacy" assessments have been completed before the end of the transition period in respect of personal data to be transferred from the UK to the EU after the end of the transition period but this may be an academic point given that the UK has already accepted in practice that GDPR and parallel pieces of EU personal data protection legislation are clearly adequate.)
On 13 March 2020 the UK Department for Digital, Culture, Media and Sport (DCMS) published 14 documents setting out an overview of the UK's personal date protection framework, to help convince the EU that the UK will have "adequate" personal data protections in place to permit the transfer of personal data from the EU to the UK after the end of the transition period. Since the UK's Data Protection Act 2018 and other data protection - related UK legislation is based on the EU's General Data Protection Regulation ( GDPR), one would hope that it would not be difficult to demonstrate the necessary adequacy.
However, robust enforcement is as important as having the necessary conceptual legal framework in place and it is hoped that the UK can satisfy the EU that the UK meets the necessary "adequacy" standards on this criterion as well.
The DCMS's work on the "adequacy" front is an important indication of the UK's commitment to getting its desired new trading and economic relationship with the EU in place before the end of the transition period.
