, ,

🇪🇺 🇬🇧 BREXIT privacy consequences: EU says no adequacy decision is coming

OK, we all know how the GDPR impacts personal data transfer outside EEA, so …will Brexit make it harder to exchange data with U.K.?


The GDPR primarily applies to controllers and processors located in the European Economic Area (the EEA) with some exceptions. Individuals risk losing the protection of the GDPR if their personal data is transferred outside of the EEA.

On that basis, under the GDPR the transfer of personal data outside the EU can freely occur towards countries that, according to the European Commission

(‘Adequacy Decision’), ensure an adequate level of protection to personal data, which are currently listed here http://bit.ly/2pxlmrU and include the United States, only if the relevant companies are Privacy Shield certified.

If none of the scenarios above applies, transfer of personal data usually occurs on the basis of:

(a) in the case of a group of undertakings, or groups of companies engaged in a joint economic activity, companies can transfer personal data based on so-called binding corporate rule;

(b) contractual arrangements with the recipient of the personal data, using, for example, the standard contractual clauses approved by the European Commission;

(c) adherence to a code of conduct or certification mechanism together with obtaining binding and enforceable commitments from the recipient to apply the appropriate safeguards to protect the transferred data.

Other scenarios and derogations apply based on the peculiarities of the case for example, where an individual has explicitly consented to the proposed transfer after having been provided with all necessary information about the risks associated with the transfer.


According to a recent (13.11.2018) official communication from the EU Commission to the European institutions regarding Brexit: “In the case of a no deal scenario, as of the withdrawal date, the transfer of personal data to the United Kingdom will become subject to the rules on international transfers

Ok, we knew that, but notably the Commission states:

In view of the options available under the legislative acts mentioned, the adoption of an
adequacy decision is not part of the Commission’s contingency planning “.

This is a big deal, since it basically means that if within 30 March 2019 (Brexit doomsday) no adequacy decision is adopted, companies shall better be ready to rely on a different tool to frame data transfers from the EU to UK.


For more info drop me a line via Twitter –  Fb or Telegram  

If you think this information is valuable, share it on your #SocialMedia, Be Influent! 

0 commenti

Lascia un Commento

Vuoi partecipare alla discussione?
Fornisci il tuo contributo!

Lascia un commento

Il tuo indirizzo email non sarà pubblicato. I campi obbligatori sono contrassegnati *

Questo sito usa Akismet per ridurre lo spam. Scopri come i tuoi dati vengono elaborati.