The end of the transition period: Implications for UK data protection after Brexit

Abstract

This paper considers the implications for UK (United Kingdom) data protection after Brexit of the European Union (EU)–UK Withdrawal Agreement, the UK’s prospects of receiving, retaining and valuing a positive adequacy decision from the EU, and the decision of the Court of Justice of the European Union in Schrems II. It highlights that although these developments considerably narrow the scope for post-Brexit divergence from EU data protection law, there remain possibilities that cannot be dismissed as minimal. In particular, it cautions that the potential erosion of data subject rights post Brexit may disproportionately impact members of lower socio-economic groups and Black, Asian and Minority Ethnic individuals. Any adequacy decision will furthermore be subject to ongoing legal challenge and precarity. The UK Government is likely to engage in brinkmanship with the Commission and the CJEU regarding adequacy and its obligations in the Withdrawal Agreement. If the UK fails to gain, or loses, an adequacy decision, then the Standard Contractual Clauses will face a similar set of ongoing legal challenges. The picture is not a happy one.