News

The impact of Brexit on EEA-UK data flows

The free movement of personal data within the EEA is a cornerstone of the Single Market – crucial to businesses and consumers operating in the EEA. For users and providers of cloud services within the EEA, it is essential for frictionless data transfers.

However, the UK government has confirmed that it will not be seeking membership of the Single Market as part of its Brexit negotiation strategy. In this article we examine comments in the UK government's white paper on principles underpinning its Brexit negotiation strategy and from the UK Minister of State for Digital and Culture, which shed some initial light on how the UK government intends to negotiate uninterrupted EEA-UK data flows.

The free movement of personal data within the EEA is a cornerstone of the Single Market – crucial to businesses and consumers operating in the EEA. For users and providers of cloud services within the EEA, it is essential for frictionless data transfers.

However, the UK government has confirmed that it will not be seeking membership of the Single Market as part of its Brexit negotiation strategy – it will be pursuing instead a new strategic partnership with the EU, which, on the face of it, would be incompatible with continued UK membership of the EEA or the EFTA. Comments in the UK government's white paper on principles underpinning its Brexit negotiation strategy and from the UK Minister of State for Digital and Culture shed some initial light on how the UK government intends to negotiate uninterrupted EEA-UK data flows.

The reason why this is a potential issue is because current and future EU data protection laws are, by default, designed to ensure the free movement of personal data between: (a) EU member states; and (b) European Economic Area (EEA) states who are not members of the EU (Iceland, Norway and Liechtenstein), but who are bound to comply with certain fundamental EU rules and restrictions in return for being included in the Single Market. Those laws restrict the transfer of personal data to "third countries" outside the EEA without adequate protections in place. On the basis that the UK will be regarded as a "third country" for data protection purposes under any Brexit model in which it falls outside of the EEA, businesses would be restricted from transferring personal data from the EEA to the UK unless: (a) the European Commission has deemed the UK to offer "adequate protection"; (b) a EU-US Privacy Shield style arrangement is agreed between the UK and the European Commission; or (c) the business uses some other form of transfer mechanism in the same way as is currently permitted by the EU Data Protection Directive (e.g. standard contractual clauses or binding corporate rules).

The UK government’s key messages on these issues are as follows:

The success of the UK government's Brexit discussions around data transfers will ultimately hinge on the UK securing a suitable solution to legitimise data transfers from inside the EEA to the UK. The possibilities include: (a) the European Commission deems the UK to offer "adequate protection"; or (b) an EU-US Privacy Shield style arrangement is agreed between the UK and the European Commission.

However, for various reasons the UK government is likely to face a number of political, legal and procedural challenges in securing an adequacy decision or alternative long-term data transfer solution despite the UK's close historical association with strict EU data protection laws, the UK government's intention to implement the GDPR in the UK from 25 May 2018 and the UK data protection regulator's public commitments to taking an active role in ensuring UK adequacy.

Businesses will therefore be closely monitoring upcoming discussions and negotiations in order to ensure appropriate transfer mechanisms are in place once the UK leaves the EU.