Archive

Consequences of the United Kingdom’s withdrawal from the European Union n° 5: Implementing the Protocol on Ireland (I) / Northern Ireland (NI)

2 July 2020

“Clarity on the practical measures that will be necessary to implement the Protocol, and the steps that businesses based in or trading with Northern Ireland need to take to prepare, is now required as a matter of acute urgency if damage to the Northern Ireland economy is to be avoided”. (House of Lords European Union Committee: Report on the Protocol on Ireland/Northern Ireland [HL Report on the P-INI] – 1 June 2020, paragraph 329).

Trade in Goods – Some Brief Facts

Most trade in goods through Northern Ireland’s ports (68%) was with Great Britain (England, Scotland and Wales). A total of 863,511 road goods vehicles passed through NI ports in 2018. Source: NISRA Northern Ireland Ports Traffic 2018 Published on June 2020. Source: NISRA Northern Ireland Ports Traffic 2018 Published in June 2020.

NI – Intersection of EU’s Customs Union & Single Market with the UK’s Internal Market

In less than six months’ time, on 1 January 2021, the P-INI to the UK Withdrawal Agreement (WA) becomes operational – whether or not a Free Trade Agreement is concluded. Northern Ireland is where the UK’s Internal Market intersects with the EU’s Customs Union and Single Market. The significance of that intersection lies in the acutely important link between economic prosperity and political stability.

The P-INI expressly recognises the unique circumstances that exist on the island of Ireland. It affirms that the successful culmination of the peace process, the Belfast/Good Friday Agreement of 10 April 1998, should be protected. Its key assumption is that there shall be no return to a hard border for the movement of goods on the island of Ireland. Practically, that objective is achieved by situating a (virtual) border between GB and NI – in the Irish Sea.

Trade in goods the tension between P-INI Articles 4 and 5

The main proposition of P-INI Article 4 is short and straightforward, it states that “Northern Ireland is part of the customs territory of the United Kingdom”. That apparent simplicity has to be read subject to Article 5 which is about customs and the free movement of goods.

P-INI Articles 5(1), 5(3) and 5(4) are more technical, they say respectively:

• P-INI 5(1) No customs duties shall be payable for a good brought into Northern Ireland from another part of the United Kingdom by direct transport, notwithstanding paragraph 3, unless that good is at risk of subsequently being moved into the Union, whether by itself or forming part of another good following processing. (…)
• P-INI 5(3) “Legislation as defined in point (2) of Article 5 of Regulation (EU) No 952/2013 shall apply to and in the United Kingdom in respect of Northern Ireland (not including the territorial waters of the United Kingdom)” (…).
• P-INI 5(4) “The provisions of Union law listed in Annex 2 to this Protocol shall also apply, under the conditions set out in that Annex, to and in the United Kingdom in respect of Northern Ireland”. (…)  (All emphases added.)

Interpretation of the combined effect of P-INI Articles 4 and 5

The reference to Regulation 952/2013 makes the entirety of the EU Customs legislation applicable in Northern Ireland. The provisions listed in P-INI Annex 2 are EU single market rules and regulations. The combined effect is to introduce what we can refer to for simplicity’s sake as red and green channels for direct transport of goods from GB to NI. Goods that are ‘at risk’ of being moved subsequently to Ireland (whether by themselves or having been incorporated in other products) will be subject to EU standards, customs treatment and EU tariffs – (red channel). The Joint Committee which is to administer the P-INI is to define what ‘at risk goods’ are. Green channel goods that are not ‘at risk’ will be subject to fewer formalities.

Reducing the complexity of implementing P-INI Article 5

The HL Report referred to at the start of this article identifies a number of potential means to mitigate the potential impact of Article 5 on Northern Ireland (at para. 98) including:

• Agreement of a comprehensive UK-EU free trade agreement;
• Streamlining customs processes;
• Implementing the Joint Committee’s definitions of goods that are ‘at risk’.
• Technological solutions;

However, neither the FTA nor these practical arrangements are yet in place.

Northern Ireland Business – Brexit Working Group (NIB-BWG) working paper

On 29 May the NIB-BWG published a detailed paper on implementing the P-INI subtitled: What Business in Northern Ireland needs and why. It sets out almost sixty practical questions about implementing the arrangements. (The paper is a response to the UK Government’s 20 May Command Paper: The UK’s Approach to the Northern Ireland Protocol. ‘Command Papers’ are official publications that set out details about major government initiatives.)

The delayed ‘Freeports’ consultation – an added complexity?

Up to ten ‘Freeports’ are to be introduced within the UK’s geographical territory but outside its ordinary customs territory including, potentially, in Northern Ireland. Freeports are intended to be innovative hubs and attract inward investment. They will have separate customs rules. The UK Government’s Freeports consultation, due to close in April, will now close on 13 July 2020.

Conclusion: A great deal remains to be done in a short time to help businesses that are either in or trading with NI make practical preparations to implement the P-INI.

 

Disclaimer: This general memorandum may not deal with every important topic or cover all important aspects of the subject matter. It is not intended, and should not be used, as a substitute for seeking appropriate legal advice on specific questions. FLINN stands ready to provide any further information that you may require.

Read More

Making compliant use of CCTV

In line with its 2020 priorities (see the previous article ‘Two years of the GDPR’), the Belgian Data Protection Authority (APD/GBA) recently published Decision 16/2020 (Decision) clarifying the regulatory requirements for use of surveillance cameras (CCTV) and keeping of compliant records.

 

Facts

Plaintiff (“P”) complained that his image was captured without his consent while walking on the pavement outside the defendant’s shop in violation of the applicable law. P stated that he could see his image displayed on a screen at the rear of the shop. He assumed the images had been recorded. The APD/GBA Litigation Chamber formally reprimanded the defendant (D) for D’s failure to declare the use of CCTV as well as failure to establish a Register of its personal data processing activities. It also required D to establish a record of all processing activities within 3 months.

 

Rules on the installation and use of CCTV

Article 6 § 2 of the “Camera Law” (Law of 21 March 2007 on the installation and use of surveillance cameras as amended and up-dated), requires a data controller who intends to install surveillance cameras in an “enclosed place accessible to the public”, such as a shop or supermarket, to notify the APD/GBA and police authorities using the mandatory electronic form before the surveillance cameras are put into operation. They must also display signs showing that CCTV is in use.

 

Register of CCTV image processing

A Royal Decree of 8 May 2018 (Royal Decree) defines the record of the image processing activities that must be kept. In addition to the data controller’s record of personal data processing (required by article 30(1) General Data Protection Regulation (GDPR) – see below) the image processing register must include information such as:

• The legal basis for the processing;
• What type of premises are concerned;
• A technical description of the surveillance cameras and, in the case of fixed cameras, a plan of the premises showing where they are installed;
• Whether or not viewing in real-time is organized and, if so, how it is organized.

 

The image processing register must be made available to the APD/GBA or to the police on request.

 

Record of personal data processing under GDPR

According to article 30(1) GDPR, any controller of personal data must keep a record of data processing activities carried out under his/her responsibility including, amongst other things:

• Name and contact details of the controller and the purpose(s) of the processing;
• Description of the categories of data subjects and the categories of personal data processed.

 

The article 30 GDPR register of processing activities is a living document which needs to evolve as the data controller’s activities change. It must be kept up to date.

 

Clarifications and confirmations made by the APD/GBA Decision

The APD/GBA Decision clarifies that it is not necessary to maintain two separate registers. A single Register can be kept, provided that it contains all the mandatory entries – including those specifically required by the Royal Decree for surveillance cameras.

The Decision also confirms that keeping of an article 30(1) GDPR register will be mandatory for most small and medium sized businesses. The four exceptions for enterprises with fewer than 250 employees set out in article 30(5) GDPR will be considered separately and interpreted narrowly.

In particular, the exception for ‘occasional’ processing of personal data is unlikely to apply in the majority of cases, because data processing related to customer management, personnel management (human resources) or supplier management is routine (in practice often monthly) and therefore not occasional.

 

 

Disclaimer: This general memorandum may not deal with every important topic or cover all important aspects of the subject matter. It is not intended, and should not be used, as a substitute for seeking appropriate legal advice on specific questions. FLINN stands ready to provide any further information that you may require.

Read More

Two years of the « GDPR »

25 May 2020

Today is the second anniversary of the date in 2018 when the General Data Protection Regulation (GDPR) became enforceable. It is also the date on which the first official evaluation of the GDPR should be made. Even if the formal evaluation is delayed – some trends can already be identified.

Requirement for an evaluation

The formal requirement for the EU Commission to submit a review and evaluation to the European Parliament and to the Council is set out in Article 97 GDPR. The first such evaluation was scheduled for today, 25 May 2020. Subsequent reviews are to be made every four years.

European Data Protection Board (EDPB) pre-evaluation

The EDPB issued its contribution to the EU Commission’s formal evaluation in February this year. It made a generally positive assessment of the GDPR but acknowledged that implementation has been especially challenging for small or medium sized enterprises (SMEs). It pointed out that the ability of the member states’ Data Protection Authorities (DPAs) to support the ‘one-stop-shop’ mechanism (intended, together with co-operation, to improve cross-border legal certainty for data controllers and data processors) depends on them being provided with sufficient resources. As regards international transfers, to third countries outside the EU, EDPB called on the EU Commission to update the existing Standard Contract Clauses (SCC’s) in-line with the GDPR and emphasised the need to adopt a set of processor-to-processor SCC’s. (The Court of Justice of the European Union is due to deliver its judgment, regarding legality of the existing SCCs, on 16 July in the Schrems II case, Case C‑311/18.)

What else do we know Europe-wide?

Before the impact of Covid-19 in April/May 2020, the number of fines per month was increasing significantly. An insufficient legal basis for data processing was the reason for the greatest number of fines. The heaviest fines were issued for a lack of technical and organisational measures to ensure data security. (Supporting statistics are available here.)

What else do we know that specifically concerns Belgium?

Although legislation creating the Belgian DPA (APD/GBA) was adopted in December 2017, the transition period towards full GDPR implementation has been relatively long. The new Executive Committee, of five directors, did not take office until 24 April 2019, just over one year ago. Priority areas for the APD/GBA’s Strategic Plan 2020-2025 include: Telecommunications and Media, Direct Marketing, Education, support for SMEs and certain societal issues, notably: use of surveillance cameras and photography, online data protection and protection of sensitive data (see the summary here).

The APD/GBA now has significant inspection and sanctioning powers. Accordingly, it has two new departments: a litigation chamber, which is supported by an inspection service. Complaints to the APD/GBA are the source of the majority of most ongoing case referrals, but current own initiative investigations of the cookies policies of online media websites are likely to be followed by reviews of several of the other ‘most consulted’ websites in Belgium.

Conclusions

The level and intensity of GDPR enforcement in Belgium and across the EU is set to increase.

 

Disclaimer: This general memorandum may not deal with every important topic or cover all important aspects of the subject matter. It is not intended, and should not be used, as a substitute for seeking appropriate legal advice on specific questions.

Read More

How can contact tracing help limit the spread of the Covid-19 coronavirus?

19 May 2020

Belgium has taken the decision that a coronavirus ‘App’ is not necessary for contact tracing. In the UK, NHSX has launched a trial on the Isle of Wight of a proprietary smartphone App. Other European countries, including Germany, have opted to deploy systems facilitated by co-operation between Apple (iOS) and Google (Android) on Blue-tooth technology. Are there clear benefits of using data applications for contact tracing? What are the potential detriments?

Contact tracing – a proven technique

Contact tracing is used to help break chains of transmission and control virus outbreaks. Using interviews and questionnaires to carry out the contact tracing manually is a well-known and proven technique. Nevertheless, it is labour intensive and time consuming. (You can consult the WHO’s report on using manual tracing to help control outbreaks of Ebola here.)

Digital proximity tracing using smartphones

The idea behind digital proximity tracing is to make use of ‘Bluetooth’ Low Energy (LE) signals, from the smartphone in your pocket, to record and estimate the distance between you and other smartphone users with whom you have come into reasonably close contact. Such tracing can establish, from among those who subscribe to and turn on the App, a list of persons to whom you have been physically close. If you test positive, contacts identified through the App can be alerted to take action, by self-isolating or accessing a Covid-19 test for example.

Centralised or decentralised digital proximity tracing?

In digital proximity tracing, users download an App to their smartphone which, when enabled, transmits random ‘identifiers’ (a string of digits) using Bluetooth LE. Other similarly enabled smartphones, that come close enough, detect and record the unique identifiers.

In a centralised system, if a person tests positive for Covid-19, the anonymised identifiers transmitted by their phone can be uploaded to the central server together with the time and duration of near contacts with other smartphones. Third-party contacts calculated to be at risk are centrally contacted and notified that they have been in proximity to an infected person.

In a decentralised system, a person who tests positive for Covid-19 self-reports their identifiers to a database. The database of positive identifiers is available to be consulted daily by all other users of the App, but any matching takes place on the user’s own device – not centrally.

The legal issues?

A balance needs to be struck between a government’s duty to protect public health and restrictions of individual rights to privacy. Even if App usage is voluntary, the health advantages must be weighed against privacy disadvantages (see the open letters here and here). Public confidence that the right balance has been struck will underpin widespread adoption.

Data Protection Authorities and Contact Tracing Apps

The ICO document about how data protection principles should be implemented in such Apps is here. Data protection aspects of the UK’s current NHSX proposal were criticised by politicians here and by an academic here. France’s CNIL emphasised that voluntariness, a correct legal basis, transparency and technical efficiency are all necessary to generate public confidence. Its cautious initial approval for a (centralised) French contact tracing system is here.

 

Disclaimer: This general memorandum may not deal with every important topic or cover all important aspects of the subject matter. It is not intended, and should not be used, as a substitute for seeking appropriate legal advice on specific questions.

Read More

Prolongation of the general moratorium provided for by Royal Decree No. 15

On Wednesday 13th of May, the Belgian Government decided to extend the series of measures contained in Royal Decree No. 15 regarding the temporary suspension of enforcement measures and other measures in favour of companies during the COVID-19 crisis. The initial date of the end of the moratorium scheduled for 17 May 2020 has been postponed until 17 June 2020, which date could itself be subject to further prolongation by further legislative decree.

Further information on Royal Decree No. 15 can be found in our article “Royal Decree No. 15 regarding the temporary suspension of enforcement measures and other measures in favour of companies during the COVID-19 crisis” and its practical implications are discussed in our FAQs:

• What impact does Royal Decree No. 15 have on the recovery of my outstanding debt?

• What precautions should be taken prior to initiating new business relationships?
• What securities may be effectively taken notwithstanding the limitations imposed by Royal Decree No. 15? 
• My debtor is known to be bankrupt, what can I do?

Read More

Royal Decree No. 15 regarding the temporary suspension of enforcement measures and other measures in favour of companies during the COVID-19 crisis

Many companies are facing a cash shortfall as a result of the COVID-19 crisis. How to protect their business’s continuity?

The judicial reorganisation procedure and the payment obligation suspension that it provides for (Book XX Code of Economic Law – CEL) is currently not regarded by the authorities to be an appropriate rescue measure because, firstly, it would overload the Companies Court during this period of crisis and, secondly, because the suspension applies only to ”old” debts that existed prior to the initiation of the procedure.

Consequently, the government has temporarily organised a moratorium, (or a ’ceasefire’) in order to protect any company in debt as a result of the Covid-19 crisis, which is in need of liquidity, against either precautionary or executory attachment proceedings, and against any bankruptcy or judicial settlement.

 

Royal Decree No 15 foresees four temporary suspension measures covering the period from 24 April 2020 to 17 May 2020 (subject to possible extension):

1. Impossibility of initiating or pursuing enforcement measures as well as precautionary or executory attachment measures

EXCEPTION: precautionary and enforceable attachment of real property (as well as precautionary attachment of seagoing and inland waterway vessels) remain possible.

2. No bankruptcy filing on summons or judicial resolution is possible

EXCEPTION: Possibility of filing a bankruptcy petition or an admission of bankruptcy on the claim by the Public Prosecutor’s Office or of a provisional administrator.

3. Extension of payment terms within the framework of a previously approved reorganization plan
4. Prohibition of unilateral or judicial termination of agreements concluded before 24 April 2020 for failure to pay a due and payable debt

EXCEPTION: employment contracts.

 

It is worth pointing out that such a system of legal suspension does not in any way affect the obligation as regards the payment of one’s debts, whether regarding principal, interest or indemnities. It is therefore in the interest of each company to respect the payments as far as possible, because following the moratorium, interest and damages can be claimed by the creditor.

To prevent certain companies from benefiting unduly from such protection, the creditor is given the possibility of summoning the debtor before the president of the Companies Court to request the withdrawal of this suspension. The President of the Companies Court, ruling as in summary proceedings, will assess whether the debtor has truly been affected by the Covid-19 crisis and subsequent measures, also taking into account the impact of the suspension with respect to the creditor’s interests so as to avoid a cascading (or ‘domino’) effect.

Furthermore, there is also a temporary suspension of the obligation to file a bankruptcy petition, if the conditions are met because of the COVID-19 pandemic and its consequences.

Lastly, the legislator intends to stimulate granting of credit, whether by a bank or by a supplier by, on the one hand, protecting new credits and, on the other hand, by lightening the potential liability of those who provide such credits. A renegotiated credit is not regarded as a new credit.

 

Read More

Consequences of the United Kingdom’s withdrawal from the European Union n° 4: the ‘Future Partnership’ negotiations

20 April 2020

The substance of the future relationship is now the principal focus of the discussions between the United Kingdom (UK) and the European Union (EU). The UK Government has made clear that, following conclusion of the Withdrawal Agreement, it considers its right to diverge from EU law and policies in future as part of its vital national interest. For its part the EU has emphasised the need for a level playing field and so called ‘dynamic alignment’ in areas that include labour law, environmental regulation and state aid.

Second round of FTA negotiations from Monday 20 April to Friday 24 April 2020

Michel Barnier, the European Commission’s Chief Negotiator, and David Frost, the UK’s Chief Negotiator, agreed to hold the second round of negotiations (postponed by almost a month from 18 March) this week. A repercussion of current travel and meeting restrictions to control the spread of the Covid-19 virus is that the negotiations will be held via video conference.

Timetable of this week’s negotiations

After the 20 April plenary session, from Tuesday 21 through Thursday 23 April there will be parallel sessions on trade in goods, trade in services and investment and on a level playing field for open and fair competition – with a relatively short political meeting, between the chief negotiators, scheduled for Friday morning. Other, shorter, parallel sessions will also take place including on fisheries, transport (aviation), transport (roads), law enforcement and judicial cooperation in criminal matters, energy (including civil nuclear cooperation), mobility and social security coordination and participation in EU programmes.

Future negotiation rounds

Two future negotiation rounds are scheduled for the weeks beginning 11 May and 1 June 2020. That leaves very little formal negotiating time before the high-level meeting to review progress scheduled for June. Under Article 132 Withdrawal Agreement (WA), the Joint Committee, established by Article 164 to oversee implementation, application and interpretation of the WA, can adopt ‘a single decision extending the transition period for up to 1 or 2 years’ before 1 July 2020. The transition period is due to end on 31 December 2020.

A possible extension of the transition period?

It will be politically difficult for the UK Government to extend what it refers to as the implementation period [for withdrawal] beyond the end of this year. Following the December 2019 general election the Conservative Party’s pledged that: “We will negotiate a trade agreement next year – one that will strengthen our [UK] Union – and we will not extend the implementation period beyond December 2020”. That pledge is enshrined in law in section 33 of the European Union (Withdrawal Agreement) Act 2020 (EU(WA)A). Although, section 41 EU(WA)A does provide a UK Government Minister with the authority to modify section 33.

Possible impact of Covid-19 on the transition period?

The Covid-19 crisis, unforeseen in both the UK and the EU in December 2019, has negatively affected economies worldwide and any joint decision on whether to extend the transition/implementation period will now be taken against that background. No negotiated deal remains a possible outcome. However, the risk is that persisting with the political deadline for ending transition/implementation will only add to the dislocation already caused by Covid-19.

Disclaimer: This general memorandum may not deal with every important topic or cover all important aspects of the subject matter. It is not intended, and should not be used, as a substitute for seeking appropriate legal advice on specific questions.

 

Read More

Consequences of the United Kingdom’s withdrawal from the European Union n° 4: the ‘Future Partnership’ negotiations

Read More

CONSEQUENCES OF THE UNITED KINGDOM’S WITHDRAWAL FROM THE EUROPEAN UNION N° 3: TRADE MARKS

The United Kingdom (UK) left the European Union (EU) on 31 January 2020 and it entered a post-withdrawal transition period that lasts until 31 December 2020. During the transition period nothing should change regarding the administration of EU Trade Marks (EUTMs). The situation becomes more fragmented in 2021, after the transition period, and some uncertainties currently remain about necessary reforms to UK trade mark law and regulations.

Transition Period: Statements from the UK Intellectual Property Office (UKIPO) (29 January 2020, last up-dated 31 January 2020)

“The UK will remain part of the EU trade mark system throughout the transition period that ends on 31 December 2020”. EUTM “will continue to extend to the UK during this time”.

“We will not create comparable UK trade mark rights on 31 January 2020. These rights will be created at the end of the transition period under the terms of the Withdrawal Agreement”.

“Businesses, organisations or individuals that have applications for an EUTM which are ongoing at the end of the transition period will have a period of nine months from the end of the transition period to apply in the UK for the same protections”. (Our emphases.)

Transition Period: Statements from the EU Intellectual Property Office (EUIPO) (29 January 2020)

The continued application of the EU Trade Mark (EUTM) Regulations during the transition period includes, in particular, “all substantive and procedural provisions as well as the rules concerning representation in proceedings before the EUIPO”.

“In consequence, all [EUIPO] proceedings that involve grounds of refusal pertaining to the territory of the UK, earlier rights originating from the UK, or parties/representatives domiciled in the UK will run as they did previously, until the end of the transition period ”.
(Our emphases.)

UK trade marks from 1 January 2021 (from UKIPO Guidance as at 30 January 2020)

From the 1 January 2021, EUTMs will no longer protect trade marks in the UK. But in accordance with Articles 54 and 55 of the Withdrawal Agreement, the UKIPO will create a comparable UK trade mark, free of charge, for all right holders with an existing EU trade mark. (UKIPO assesses it will need to convert almost 1.4 million EU trade marks and provide equivalent UK trade marks at the end of the transition period.)

If you have a pending EUTM application, you will be able to apply to register a comparable UK trade mark in the 9 months after 1 January 2021 subject to paying the usual UK registration fees of £170, which includes one class of goods or services, and an extra £50 for each additional class of goods or services. (The earlier filing date of the pending EUTM will be kept.)

International registrations designating the EU from 1 January 2021

On 1 January 2021, (Madrid System) international trade mark registrations designating the EU will no longer be valid in the UK. In accordance with the Withdrawal Agreement Article 56, the UKIPO and WIPO are discussing options to ensure that rights holders do not lose protection in the UK on 1 January 2021 for their internationally protected EU trade mark registrations.

In addition, amendments to the UK Trade Marks Act 1994, to the UK Trade Marks Rules 2008, (and to other amending and standalone regulations), will be required to reflect the fact that, the UK will no longer be part of the EU trade mark system after 1 January 2021.

 

Disclaimer: This general memorandum may not deal with every important topic or cover all important aspects of the subject matter. It is not intended, and should not be used, as a substitute for seeking appropriate legal advice on specific questions.

 

Read More

CONSEQUENCES OF THE UNITED KINGDOM’S WITHDRAWAL FROM THE EUROPEAN UNION: N° 2 DATA PROTECTION

The United Kingdom (UK) left the European Union (EU) on 31 January and it entered a post-withdrawal transition period.

Statement from the UK Information Commissioner’s Office (ICO) (29 January 2020)

“During [the transition] period, which runs until the end of December 2020, it will be business as usual for data protection”. (Our emphasis)

“The GDPR will continue to apply”. (…)

The UK continues to be considered an EU Member state during the transition period

For (most) legal purposes the UK will continue to be considered as an EU Member State until the end of the transition period (31 December 2020). Withdrawal Agreement (WA) Article 127 6. states:

“Unless otherwise provided in this Agreement, during the transition period, any reference to Member States in the Union law applicable” (…), “shall be understood as including the United Kingdom”. (Our emphasis.)

The Withdrawal Agreement

The WA is an International Treaty. It is intended to be attended by legal consequences and to be enforceable. Title VII WA (Articles 70 to 74), specifically concerns Data and Information.

The effect of WA Article 71(1)(a) is that the rules of the GDPR continue to apply for personal data transfers between the European Economic Area (the EEA is the EU plus Iceland, Liechtenstein and Norway) and the UK as from 1 February 2019. Thereafter, WA Article 71(2) appears to assume that during the transition period a finding of ‘adequacy’ will be made in respect of the United Kingdom’s data protection regime.

‘Adequacy’ is important

The general rule (under Chapter V of the GDPR), is that controllers and processors cannot transfer personal data outside the EEA to ‘third-countries’ (such as the UK) unless adequate levels of data protection can be ensured. In the absence of a general finding of adequacy in respect of a third country contractual methods need to be used to enable such transfers.

ICO’s statement acknowledges the potential for uncertainty

“It is not yet known what the data protection landscape will look like at the end of the transition period and we recognise that businesses and organisations will have concerns about the flow of personal data in future”.

“We will continue to monitor the situation and update our external guidance accordingly”.

More information available from: ICO’s Brexit related guidance and resources

Read More