The implications of a ‘no-deal’ Brexit for data protection in the United Kingdom

Abstract

A ‘no-deal’ Brexit will have important implications for international data transfers from the European Union (EU) to the United Kingdom (UK). It will both impose costs on and harm the competitiveness of many UK-based companies. A sharp ‘cliff-edge’ for international data flows, however, is less likely. UK-based companies will need to rely on Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) for international data transfers from the EU in the event of a no-deal Brexit. Many larger companies are likely to have already taken steps towards implementing such measures. In addition, very considerable progress has been made by the UK and third countries with EU adequacy decisions in their favour to ensure that international data flows are maintained. The most significant implication of a no-deal Brexit is in the medium term. A no-deal Brexit makes it more likely that any attempt to seek an EU adequacy decision for future international data transfers for the UK will fail. This increases the prospect of weakening existing protections for the personal data of UK-resident data subjects in both the UK and abroad and in both the public and private sectors. This paper analyses the implocations of a no-deal Brexit for UK data protection law.