Deal or no deal? Brussels outlines the data protection implications of Brexit walk away
- Summary:
- It's 'no deal' brinksmanship at the moment over Brexit, but Brussels is starting to play its hand with a warning about data transfer complexities if talks falter.
The week began with UK Prime Minister Theresa May supposedly set to appoint a Cabinet Minister with responsibility for putting in place the mechanics of a ‘no deal’ walk away from the EU. In the event, when the ensuing shambles of the government reshuffle had settled down, no such individual was in office and there were puzzled denials from ‘sources close to’ that there had been any such pre-briefings, sorry, plans.
But that didn’t stop the Minister for Exiting the EU, David Davis, writing to the PM to protest that his Eurocrats in Brussels were discriminating against the UK and damaging its economic interests by preparing for a no deal situation in March 2019.
That brought a tart response from EC chief spokesman Margaritis Schinas who said that the Commission was only responding to the UK’s own agenda:
Here in the European Commission we are somehow surprised that the UK is surprised that we are preparing for a scenario announced by the UK government itself. After all, it was PM May herself who said in her Lancaster House speech in January 2017 and repeated in her Florence speech in September that, and I quote, ‘No deal is better than a bad deal for Britain. It is right that the government should prepare for every eventuality’. We take these words from the prime minister very seriously. It is therefore only natural that in this house we also prepare for every eventuality.
So far, so political push-and-shove. But yesterday the Commission upped the ‘no deal’ stakes with a stark warning of the damaging impact that such an outcome would bring in terms of cross border data transfer.
The EC Directorate-General Justice and Consumers stated for the first time that as soon as the UK leaves the EU, it assumes that status of a third party, which has considerable implications for data protection. Most significantly, the statement carries an underlying threat that adequacy by default should not be assumed post-Brexit unless specific agrements are reached in advance. It notes:
The United Kingdom submitted on 29 March 2017 the notification of its intention to withdraw from the Union pursuant to Article 50 of the Treaty on European Union. This means that unless a ratified withdrawal agreement1 establishes another date, all Union primary and secondary law will cease to apply to the United Kingdom from 30 March 2019, 00:00h (CET) ('the withdrawal date'). The United Kingdom will then become a 'third country'.
In view of the considerable uncertainties, in particular concerning the content of a possible withdrawal agreement, all stakeholders processing personal data are reminded of legal repercussions, which need to be considered when the United Kingdom becomes a third country.
There are mechanisms that can be used to ensure data transfer, the Commisson reminds the UK, such as:
- Standard data protection clauses: the Commission has adopted three sets of model clauses which are available on the Commission’s website.
- Binding corporate rules: legally binding data protection rules approved by the competent data protection authority which apply within a corporate group;
- Approved Codes of Conduct together with binding and enforceable commitments of the controller or processor in the third country;
- Approved certification mechanisms together with binding and enforceable commitments of the controller or processor in the third country.
But the underlying message is simple - things could get much more complicated if it’s ‘no deal’ in March next year.
My take
None of this is new, but it’s now clear that if ‘no deal’ is a realistic option, then it’s not just a one-sided threat from the UK. The Eurocrats are going to lay out all the legislative complexities that will result and keep doing so. There were two further ‘what will happen next’ statements yesterday alone. Brinksmanship is only going to stretch so far.