July 24, 2019

July 23, 2019

Subscribe to Latest Legal News and Analysis

July 22, 2019

Subscribe to Latest Legal News and Analysis

Brexit and UK-US data transfers: What’s the plan?

Despite the overall political uncertainty about Brexit, worries about a sudden stop to personal data transfers from the UK to the US are misplaced, deal or no deal.  There is, in fact, a plan, and it’s a reasonable, practical plan.

The UK government plans to use its regulatory powers to ensure that prior arrangements between UK data exporters and data importers in other countries continue uninterrupted.  That includes recognizing existing Standard Contractual Clauses between UK data exporters and non-UK data importers.  The UK government will also recognize the EU Commission’s Adequacy Decisions, including the decision regarding Privacy Shield.  So US companies that import personal data from UK companies under the Standard Contractual Clauses or Privacy Shield don’t need to do anything.

What about personal data transfers between organizations in the UK and those in the EU?  The UK has already adopted the GDPR into its national laws by way of the Data Protection Act 2018.  The UK government will recognize the EEA countries (which includes the EU-27) as providing adequate protections, so UK data exporters can send UK personal data freely to the EU.  The rules on the reverse data flows (EEA to UK) are outside of the UK government’s control, of course.  The EU has signaled that it will not grant the UK an Adequacy Decision automatically, despite the extremely close alignment of the UK’s Data Protection Act 2018 and the GDPR. Accordingly, the UK government has advised UK data importers to execute SCCs with EEA data exporters.  It’s worth noting that the EU’s go-slow position on granting an Adequacy Decision to the UK imposes an equal burden on EU businesses that want to export personal data to the UK and the UK businesses that want to import it.

See the UK Government’s guidance on Brexit and data transfers here.  Section 2 addresses a no-deal scenario.  As of the date of this blog post, the guidance was last updated on Feb. 13, 2019, so it does not reflect the EU’s agreed extension of a “No Withdrawal Agreement” exit date to April 12, 2019, or a “With Withdrawal Agreement” exit date to May 22, 2019.

©1994-2019 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.


About this Author

Susan L. Foster, Mintz Levin Law, Information Privacy Lawyer, Start Up Attorney

Susan is qualified in England and Wales as well as California, and has experience practicing law in both the United States and the United Kingdom. She has been based in Mintz Levin’s London office since September 2007, and worked in the United Kingdom for another international law firm from 2001 to 2004.

Susan works with clients primarily on licensing, collaborations, and commercial matters in the fields of clean tech, high tech, mobile media, and life sciences. She has represented a broad range of clients, from start-up companies to international industry leaders, and has...