www.bifa.org


Policy & Compliance


BIFAlink


relationship is reached before the end of the transition period. Companies with contracts subject to English law, whose contractual position may be adversely affected, should not assume that they will be protected by force majeure or material adverse change clauses, unless they have been carefully drafted to cover the specific scenario, or the common law doctrine of frustration.


Data protection From the end of the transition period, the UK will be classed as a ‘third country’ from the perspective of EU/EEA data protection law, including the General Data Protection Regulations (GDPR). Chapter V of the GDPR requires that businesses that transfer personal data outside of the EEA to third countries ensure that the level of protection given to that personal data by the GDPR is not undermined as a result of the transfer. Unless the third country is the subject of an adequacy


decision of the European Commission – in which case businesses can generally freely transfer personal data to that country without restrictions – a business transferring personal data needs to ensure that one of the safeguards set out in Article 46 of the GDPR applies to the transfer, or one of the derogations set out in Article 49 of the GDPR can be relied on for the transfer. It is possible that the UK could be granted an adequacy


decision by the end of the transition period (whether or not combined with a wider agreement on future relationship), but this cannot be guaranteed. Businesses should review now what safeguards could be put in place, or what derogations could apply, to their transfers of personal data from the EEA to the UK. The use of Standard Contractual Clauses (SCCs) – one of the approved safeguards – is likely to be the most practical


October 2020


route for businesses lawfully to transfer personal data from the EEA to the UK. However, the recent Schrems II judgment of the Court of Justice of the European Union (CJEU) emphasises that, in addition to making transfers of personal data subject to these clauses, the transferor of personal data must also be satisfied that UK law would not undermine the level of protection afforded to personal data by the GDPR. Whilst UK data protection law is, and will continue for the


foreseeable future to be, based on the GDPR standard, potential concerns over the widespread powers of UK authorities to access personal data, such as those contained in the Investigatory Powers Act 2016, may make it difficult for transferors of personal data to be satisfied that UK law would not undermine the level of protection afforded to personal data by the GDPR, as they must do in order to use the SCCs lawfully. This could create difficulty as no other potential safeguard or derogation may apply in individual cases. Future guidance of the European Data Protection Board, European Commission (Commission) and the UK’s Information Commissioner’s Office, may provide greater certainty. Transfers of personal data from the UK to the EEA and to


countries that currently benefit from a Commission adequacy decision should remain unaffected. Companies based in the UK that offer goods or services to individuals in the EEA, or which monitor the behaviour of individuals in the EEA, are also likely to be required to appoint a data protection representative in the EEA. In all probability when the UK voted to leave the EU, few


realised the complexity of disentangling the regulation and resulting systems and procedures in order for the EU exit procedure to be completed. Whilst trade and Customs are two of the biggest issues, how to handle data covered by GDPR regulation poses significant challenges.


BIFA is grateful to Holman Fenwick Willan LLP for its permission to reproduce this article.


13


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24