UK no longer a safe third country as of April 2019
21/08/18 10:01
After Brexit, the United Kingdom will be regarded as a third country under data protection law, as the GDPR will no longer apply there once the United Kingdom leaves the country on 30 March 2019.
However, a so-called EU adequacy decision could minimise the impact of Brexit on data exchange between the UK and the EU. However, it is uncertain at this stage whether the United Kingdom will be able to establish an adequate level of data protection before Brexit in order to obtain a timely adequacy decision from the European Commission.
Art.46 I GDPR provides that a transmission is also possible without an adequacy decision (Art.45 GDPR), but only with suitable guarantees. Art.46 II GDPR, which lists various possibilities, shows how these guarantees can be provided.
If there is no adequacy decision and if companies themselves do not create guarantees in accordance with Art.46 GDPR, high fines may be imposed under Art.83 GDPR.
It is not yet absolutely necessary for EU companies to adapt documents and processes. However, EU companies should already be preparing to take appropriate action, as sufficient preparation by the UK is not certain and non-GDPR-compliant data exchange with UK companies could lead to audits by regulators and heavy fines.
However, a so-called EU adequacy decision could minimise the impact of Brexit on data exchange between the UK and the EU. However, it is uncertain at this stage whether the United Kingdom will be able to establish an adequate level of data protection before Brexit in order to obtain a timely adequacy decision from the European Commission.
Art.46 I GDPR provides that a transmission is also possible without an adequacy decision (Art.45 GDPR), but only with suitable guarantees. Art.46 II GDPR, which lists various possibilities, shows how these guarantees can be provided.
If there is no adequacy decision and if companies themselves do not create guarantees in accordance with Art.46 GDPR, high fines may be imposed under Art.83 GDPR.
It is not yet absolutely necessary for EU companies to adapt documents and processes. However, EU companies should already be preparing to take appropriate action, as sufficient preparation by the UK is not certain and non-GDPR-compliant data exchange with UK companies could lead to audits by regulators and heavy fines.