In an increasingly digital economy, movement of personal data within and across borders is an everyday part of the financial services sector and beyond. It is vital to ensure that this can continue beyond the UK’s exit from the EU.
The IRSG believes that the most legally sound and stable option of ensuring the continued ability to transfer personal data between the UK and the EU27/EEA and international destinations is to secure mutual adequacy decisions between the UK and the EU.
The IRSG has identified the following requirements which it believes will assist in delivering this:
UK to undertake full implementation of the GDPR by May 2018
Assessment and removal by HMG of likely obstacles to the UK achieving an adequacy decision
HMG to request the European Commission to begin pre-departure preparations for an adequacy decision
HMG to seek an appropriate set of transitional measures to avoid a cliff-edge scenario and seek ‘in principle’ agreement as soon as possible, in order to provide business certainty
UK to continue to maintain high data protection standards post Brexit to support an adequacy decision remaining in situ
The paper also analyses the alternative options to adequacy, but concludes that they fall far short of the needs of business, as they do not provide legal certainty, are of limited application and are complex and time-consuming to introduce.
Impact of Brexit on Personal Data Transfers
Published 6 Feb 2018
In an increasingly digital economy, movement of personal data within and across borders is an everyday part of the financial services sector and beyond. It is vital to ensure that this can continue beyond the UK’s exit from the EU.
The IRSG believes that the most legally sound and stable option of ensuring the continued ability to transfer personal data between the UK and the EU27/EEA and international destinations is to secure mutual adequacy decisions between the UK and the EU.
The IRSG has identified the following requirements which it believes will assist in delivering this:
The paper also analyses the alternative options to adequacy, but concludes that they fall far short of the needs of business, as they do not provide legal certainty, are of limited application and are complex and time-consuming to introduce.