Last month we reported on the EU Digital Single Market, which is due to come into effect before the UK’s planned departure date from the EU on March 30th 2019.
But with Brexit looming, how long will British businesses be subject to the free movement of data as prescribed by the Digital Single Market, and what might happen if and when this so-called ‘fifth freedom’ comes to an end in the UK?
On July 19th 2018 the European Commission published a press release urging EU27 businesses – the ‘rest of the EU’ not including the UK – to ramp up their preparations for Brexit, even as negotiations continue over the precise terms of the UK’s departure.
The transfer of personal data under the EU’s fifth freedom, the freedom of movement of knowledge, is one element in these preparations – so what did the EC say on the matter?
Will Brexit change the freedom of movement of data?
In its press release of July 19th, the EC said: “Currently, personal data can flow freely between the Member States of the EU. Post-Brexit, the transfer of personal data from the EU to the UK is still possible, but it will be subject to specific conditions set in EU law.
“Companies that are currently transmitting personal data to the UK should be aware that this will become a transfer of personal data to a third country.
“If the UK’s level of personal data protection is essentially equivalent to that of the EU, and certain conditions are fulfilled, the European Commission may adopt an adequacy decision which allows for transfer of personal data to the UK without restrictions.
“However, companies should assess whether, in the absence of an adequacy decision, measures are necessary to ensure that these transfers remain possible.”
Remember that the UK will (if everything goes as planned) already implement the rules of the EU Digital Single Market by the end of 2018, so it might be expected that the UK and EU27 will have closely comparable rules on personal data protection at that time.
When might things change post-Brexit?
If the European Commission adopts an adequacy decision, UK firms should be able to freely transmit data to EU27 member states indefinitely, unless our legislation on personal data protection significantly diverges from the EU’s in the coming years.
However, there are still several landmark dates to watch out for:
- March 30th 2019 – Brexit day. As of midnight at the start of March 30th, the UK ceases to be a Member State and if no deal is agreed before then, this could see freedom of movement of data cease overnight.
- January 1st 2021 – Transition day. If a deal is reached before March 30th 2019, it is likely to incorporate a 21-month transition period, which would end at the start of 2021.
- Adequacy decision – This should allow indefinite transmission of personal data cross-border, but would be subject to personal data protection in the UK remaining very similar to that in the EU27, so any future legislative changes could theoretically lead to it being revoked at short notice.
Comcare are keeping on top of the fast-moving changes and announcements in this area, and will be happy to advise customers on any necessary changes to the way you store and transmit data throughout Brexit and any transition period that follows.
http://europa.eu/rapid/press-release_IP-18-4545_en.htm
https://ec.europa.eu/info/sites/info/files/factsheet-preparing-withdrawal-brexit-preparedness-web_0.pdf