At 11 pm GMT today, 31 January 2020, after much to-ing and fro-ing the United Kingdom will finally leave the European Union.
Is there now a need for action for those responsible for data protection? YES and NO!
NO, because during the transition period, which will last at least until 31 December 2020 (an extension of a maximum of two years is possible), legally everything will remain the same. The United Kingdom will continue to be treated as if it were still part of the EU. The GDPR will continue to apply in the United Kingdom during such transition period. Data transfer is therefore possible without special conditions in the same manner as between responsible parties within the EU.
YES, because it is still unclear what will happen after the transition period. Those responsible must be prepared for all possible scenarios. After the end of the transition period there may be an adequacy decision by the EU. In that case, there will still be no need for specific conditions for the exchange of personal data with recipients in the United Kingdom. If, on the other hand, no adequacy decision is made, the data controller must be able to demonstrate specific guarantees, for example by using the standard data protection clauses or binding corporate rules.
Data controllers who rely on data exchange with recipients in the UK must use the transition period to lay the foundations for further smooth data transfers to the UK. PWWL is happy to support you in this process.