A leading data protection lawyer has warned businesses that they shouldn’t relax just because there’s a trade deal. There are many challenges still to overcome.
One of the key announcements in relation to data from the Trade and Cooperation Agreement (TCA) was the news of a “bridging period” of up to six months which allows personal data to continue to be sent to the UK.
This allows the European Commission time to conclude its adequacy assessment of the UK. Without this bridging period, EEA-UK data transfers would otherwise have been restricted and organisations would have had to put in place additional safeguards at the end of the Brexit transition period.
The bridging period is subject to two main conditions. The UK must not make any changes to its data protection law and the UK data protection regulator must not approve new transfer mechanisms or Codes of Conduct, without the consent of the EU-UK Partnership Council.
Despite this development, specialist lawyers at Irwin Mitchell say there are many issues to consider and that if personal data is important to a business, it must focus now on its long term data protection arrangements.
It should also be borne in mind that even if adequacy is granted it is likely that it will be challenged in the EU Court
Joanne Bone, partner at Irwin Mitchell specialising in data protection, said: “The summary document issued by the Government paints a very rosy view of the TCA in relation to data and I think the reality is quite different.
“Whilst the data export issue is sorted for the next six months, If adequacy is not agreed in the next six months, then the whole export issue comes back into play and, in fact, the ICO has issued a comment that UK businesses should prepare for there being no adequacy by putting in place standard contractual clauses over the next few months.”
Joanne added: “The TCA also only solves part of the problem from a data protection point of view as there are other requirements that UK businesses need to think about which remain an issue. These include whether a representative is needed, updating documentation including policies, privacy notices, DPIAs, loss of the one stop shop and double jeopardy regarding fines.
“It should also be borne in mind that even if adequacy is granted it is likely that it will be challenged in the EU Court – privacy campaigners have already said this is what they will do.
“I don’t think this is the end of the Brexit and data protection issues, but the TCA buys time in the short term.”
