All Irish entities transferring personal data between Ireland and the UK need to be aware of impending changes in the event of a “no deal” Brexit from the EU.
The free movement of personal data between EU member states is guaranteed under EU data protection law. In the absence of a Brexit deal, the UK will be designated as a ‘third country’ for the purposes of personal data transfers – thereby becoming subject to the EU rules for transfer of personal data to third countries.
The easiest way to transfer personal data outside the EU is where the third country in question has been deemed as having an “adequate” data protection regime. The Irish Data Protection Commissioner ("DPC") has advised that no such recognition of the UK’s data protection regime will be in place by March 2019.
What does this mean for Irish companies sending personal data to the UK?
Irish-based organisations transferring personal data to entities in the UK will need to implement legal safeguards to ensure continued application of the EU’s data protection standards.
The most widely used alternative mechanism for transfers is standard or model contractual clauses, approved by EU Commission. These clauses implement contractual safeguards between the data exporter and the data importer.
What about data flows from the UK to Ireland after March 2019?
The Irish DPC notes that according to the UK Government the current practice, which permits personal data to flow freely from the UK to the EU member states, will continue in the event of a ‘no deal’ Brexit.
How do Irish companies prepare for a “no deal” scenario?
Time is running out. Irish companies have just 64 days left to prepare for the increasing possibility of a “no-deal” Brexit.
The DPC has set out the following steps for Irish and EU companies transferring personal data to the UK to consider:
- Review what personal data the company currently transfers to the UK;
- Decide whether or not these transfers need to continue beyond 30 March 2019; and
- If the answer is yes, consider the best transfer mechanism available and ensure that it is in place before 30 March 2019.
Businesses and other organisations that move personal data between the Republic and the UK will have to put in place new legal structures to do so in the event of a no-deal Brexit, it has been announced.