NO DEAL BREXIT VS GDPR
Two of the most hot topics nowadays evolve around Brexit and the GDPR. In this Article, we will briefly examine the effect that one will have to the other.
Organizations within and outside of the UK must be prepared to face the consequences of a no-deal Brexit and ensure compliance with data protection principles and regulations.
In the event that the UK leaves the EU with no deal, this means that no agreed principles will be implemented in terms of, among others, data protection matters/transfers and organizations must be prepared to face such a situation and put in place measures in order to be in compliance with the GDPR.
UK faces the risk of being identified as a third country, which in essence means that it will be subject to scrutiny in terms of compliance with data protection laws and in particular the GDPR.
Although the UK government has stated that it will permit data to flow from the UK to EEA (European Economic Area) countries, however, organisations that transmit data from the EEA to the UK will be affected and will need to strictly follow the provisions of the GDPR in relation to transmission of personal data to third countries (Articles 44 to 50).
B. ADEQUACY DECISION
The Commission has the power to award the UK with an adequacy status in accordance with the provisions of Article 45 of the GDPR, which sets out what the Commission should consider and assess in terms of making a decision as to whether to grant a third country with an adequacy status or not. In the event that the UK is granted with an adequacy status, then data will flow freely from the EEA to the UK without the need for extra safeguards, as if such flow was made to an EEA country.
The Commission has so far granted and adequacy status to Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, Uruguay and the United States of America (limited to the Privacy Shield framework) and recognised them as countries providing adequate protection.
The adequacy status of the UK under Article 45 of the GDPR remains to be seen.
C. TRANSMISSIONS OF PERSONAL DATA TO THE UK BEING A THIRD COUNTRY:
It is expected that the UK will not initially be awarded with the adequacy status by the Commission. As a result, organizations with the EEA must be ready to comply with the provisions of the GDPR regulating the transmission of data to third countries (Articles 46 to 49).
As a result, EEA organizations are expected to provide adequate safeguards for the flow of personal data from the EEA to the UK, which as per the GDPR comprise of the following:
a legally binding and enforceable instrument between public authorities or bodies;
Standard data protection clauses adopted by the Commission;
Standard data protection clauses adopted by a supervisory authority and approved by the Commission;
Binding Corporate Rules;
Codes of Conduct and Certification Mechanisms;
In the event that the UK elects the no- deal Brexit route, this would have a serious impact on organizations dealing with data flows from the EEA to the UK. As mentioned above, the UK Government has stated that data flows from the UK to the EEA shall remain unaffected. EEA organizations must be prepared for such a scenario, in order to remain in compliance with the provisions of the GDPR. It is anticipated that the UK will eventually be awarded with the adequacy status, in order for data to flow freely as they currently flow within EEA countries. If, however, the UK reaches a deal with the EU, then it is definite that such an arrangement will include provisions and agreements in relation to data protection matters.
This publication has been prepared as a general guide and for information purposes only. It is not a substitution for professional advice. One must not rely on it without receiving independent advice based on the particular facts of his/her own case. No responsibility can be accepted by the authors or the publishers for any loss.
Senior Associate Lawyer
We are a Law Firm with offices in Cyprus and Malta and a representative office in Shanghai China comprising of more than 80 lawyers, accountants and other professionals who advise, international and local clients.
The Firm has been offering legal and consulting services since 1983 evolving from a traditional law firm to an innovative cutting-edge multidisciplinary law firm combining exceptional expertise in law, tax, vat and accounting.
From its establishment the Firm’s focus has been heavily business oriented and always abreast with the latest global developments and innovations. Drawing from our pool of experienced professionals we provide our clients’ businesses full legal and accounting support on an everyday basis as well as customized solutions in today’s global financial and legal challenges.
We consider ourselves as ‘traditional pioneers’ and our motto is to foresee and anticipate any issues that may potentially impact our clients’ business and to offer effective advice and solutions proactively.
Lawyers’ Limited Company
12 Egypt Street, 1097, Nicosia
P.O. Box 22303, 1520 Nicosia, Cyprus
Tel: + 357 22 55 88 88 – Fax: + 357 22 66 25 00
Civil Partnership, Law Firm
Kinanis Fiduciaries Limited
Suite 20, The Penthouse, 4th Floor, Ewropa Business Centre,
Dun Karm Street, Birkirkara, BKR 9034, Malta
Tel: + 356 27 54 00 24, Fax: + 356 27 54 00 25
Kinanis (China) Limited
China Representative Office
Unit 661, 6/F CIROS PLAZA,
388 Nanjing West Road, Huangpu District,
Shanghai City, 200003, China
Tel: + 86 18 410 072 690
is the service mark through which Kinanis LLC of Cyprus, Kinanis Fiduciaries Limited of Malta, Kinanis, Civil Partnership, of Malta, Kinanis (China) Limited of Cyprus and their affiliated companies are conducting their business each of which is a separate legal entity.