Skip to content


Withdrawal Agreement Brexit Gdpr

During this transition period, the UK government and the EU will ideally negotiate a data protection agreement tailored to both parties, whether it is an adequacy decision, a Privacy Shield agreement or any other agreement allowing for the free flow of data between the UK and the EU. The UK and the EU have said they are “obliged to ensure a high level of protection of personal data to facilitate such flows between them” and hope to have reached agreements by the end of the transition period. However, the Privacy Shield, like its predecessor, the Safe Harbor Agreement, has been declared invalid by the CJEU because the United States does not provide adequate protection of personal data within the meaning of the GDPR. The creation of ODA 2018 was an integral part of this commitment. Once the UK leaves the EU, it will be given “third country” status, a classification that requires countries to comply with robust data laws that offer protection equivalent to that of the EU. This safeguard measure, known as the adequacy agreement, aims to ensure that the data of natural persons within the EU is protected when it is transferred to a country outside their jurisdiction. If an adequacy decision is not made, another option could be a Privacy Shield agreement, similar to the one currently in place between the UK and the US. If no trade agreement, agreement or agreement is concluded between the UK and the EU after this transition period, the UK will leave the country in a no-deal scenario and become a “third country”. As CSOs have already pointed out, in such a scenario, UK organisations and organisations with offices in the UK that receive personal data from the EU need to ensure that they have additional legal controls, such as standard contractual clauses. B or binding corporate rules, to ensure compliance with the GDPR.

Countries outside the EU continue to be subject to the GDPR and EU fines for processing the personal data of EU citizens. Under the agreement, a transition period runs until 31 December 2020, during which the current EU rules will continue to apply to the UK and negotiations can start on what happens next (the option to extend the transition period has been removed from the latest version). A negotiated deal is now seen as the only way to ensure that the UK is able to obtain EU permission to transfer data to the UK, although there is no guarantee that an agreement would include this provision. In the context of Brexit, this means that the UK could use CSCs if a data transfer agreement is not formalised as part of a negotiated withdrawal. .

Posted in Uncategorized.