Among other things, 2018 will go down in history as the year of panics over data protection. First, it was the GDPR and its impossible deadline for compliance. Now it is Brexit and the uncertainty as to what it will mean. The famous phrase "Brexit means Brexit" is as cryptic today as it was two years ago. But now, with six months to go for the U.K.'s scheduled departure from the European Union, the uncertainty of not knowing what Brexit will look like seems paralyzing. The outcome of the Brexit negotiations – aimed at settling the terms of the future relationship between the U.K. and the EU – defies prediction, yet the need to prepare for Brexit's aftermath is pressing.
For those with responsibility for data protection compliance in the U.K. and abroad the question is a simple one: What will be the impact of Brexit on my organisation and what do we need to do about it? The answer largely depends on what kind of Brexit we will end up with, so let's try and assess the chances of each possible scenario.
Scenario 1 – Soft Brexit (aka "The Chequers plan")
A soft Brexit would involve formally leaving the EU with the minimum possible impact, bearing in mind what is realistically and politically achievable. This is in fact what the U.K. government appears to be aiming for. In data protection terms, this would be a nirvana-like situation involving the continued unhindered exchange of personal data between the U.K. and the EU and the ability for the Information Commissioner's Office to participate in the "one stop shop" mechanism of regulatory oversight. Given the adoption of the GDPR as the U.K.'s own data protection framework, optimism in this respect would not be entirely ill-founded, but for this to happen the U.K. and the EU would need to find the same level of understanding across all political issues on the table.
Likelihood: 20%
Scenario 2 – Semi-soft Brexit
A more achievable outcome would be to agree a deal that does not give the ICO a formal role as part of the "one stop shop" mechanism, but focuses on ensuring the free flow of personal data between the EU and the U.K. This would require the European Commission to commit to granting an adequacy finding – assuming that the conditions are met – either at the point of exit or during the agreed transitional period at the latest. In practical terms, this would mean that U.K. organizations would continue to operate as safe recipients of EU data in exactly the same way they do today. This would also probably allow the ICO to continue to be involved in the binding corporate rules authorization process, which would be massively welcomed not only by multinational organizations seeking BCR approval but by other EU data protection authorities working in this area.
Likelihood: 40%
Scenario 3 – Semi-hard Brexit
If things get rocky and the political will is not there, we could see a cordial but terse Brexit process. In this situation, everyone would be technically playing by the book without much regard for the "special relationship" that the U.K. and the EU should be aiming to have. So the European Commission would treat the U.K. in a nominally neutral way, whilst the U.K. would need to seek adequacy in the knowledge that the level of scrutiny would be meticulous, to say the least. Adequacy would eventually be granted, but it would be unwise to expect any sort of fast-tracking. In practice, this would mean several years during which U.K. recipients of data from the EU would have to make up for the lack of adequacy by applying appropriate safeguards through contractual arrangements, BCR or similar legal tools.
Likelihood: 30%
Scenario 4 - Hard Brexit (aka "No deal Brexit")
Potentially, everything could go pear shaped. Judging by the way some hard-core Brexiteers continue to proclaim the virtues of a "no deal Brexit," this scenario would not only be possible but somewhat desirable. From a data protection compliance perspective, however, this would firmly close the door to any hopes of an EU adequacy finding or a role for the ICO among fellow data protection authorities. Political hostility would lead to a lack of understanding, which would even render an EU-U.K. Privacy Shield-type arrangement impossible. Given that in reality this is in no one's interest, this scenario seems unlikely but, if it happened, legitimizing international data flows would potentially be an uphill struggle for any U.K. organization seeking to do business with EU-based counterparts.
Likelihood: 10%
Taking all of this into account, it is obvious that undertaking some practical preparation is essential. Whatever the plan, it should be kept under review but, as a minimum, anyone seeking to address the impact of Brexit on data protection should be:
- Assessing existing and future data transfers between the EU and the U.K.
- Identifying suitable mechanisms to legitimise data transfers in the event of no EU adequacy finding for the U.K.
- Considering alternative lead authorities to the ICO – both for the purposes of the "one stop shop" and new BCRs.
- Keeping a close eye on the ongoing negotiations between the U.K. and the EU.
photo credit: The Prime Minister's Office PM signs Article 50 letter via photopin (license)
5 Comments
If you want to comment on this post, you need to login.
Likelihood of alternative mechanisms: Contractual arrangements - 50% ( a lot of larger firms will use these already for non-EU partners) Consent - 20% (automatic fall back / panic position. See marketing consents and privacy notices pre-GDPR) BCR - 10% (whether used correctly or not) "One-off" or "Public interest" - 5% (" " because whether the transfers are truely one-off or in the public interest will be debatable; will be used short term until adequacy / privacy shield is in place) No safeguard or other derogation - 15% (no safeguards)