Firms face scramble for post-Brexit data transfer deals

Brussels data protection chiefs have issued yet another shot across the bows to UK-based companies which transfer data to and from the EU, warning them that existing agreements that have been signed off by the Information Commissioner’s Office will be invalid in just over 150 days.

The European Data Protection Board has urged firms which use so-called “binding corporate rules” (BCRs) that they must get approval from other EU data protection regulators as, from December 31, the ICO “will no longer qualify as a competent supervisory authority”. However, time is not on their side – it can take between six and nine months to get BCRs approved.

According to the European Commission website, brand owners which use BCRs approved by the UK regulator currently include Astra Zeneca, Accenture, American Express, BP, BT, Citigroup, Ernst & Young, GlaxoSmithKline, Hyatt, IBM, IMS, Motorola and Verizon Communications. Data centre giant Equinix has reportedly already decided to switch to the Dutch regulator.

The EDPB stated: “As the ICO will no longer qualify as a competent supervisory authority under GDPR at the end of the transition period, the approval decisions of the ICO taken under GDPR will no longer have legal effect in the European Economic Community.

“In addition, the content of the BCRs in question may need to be amended before the transition period ends, as these BCRs generally contain references to the UK legal order.

“[Companies] need to put in place all organisational arrangements to identify a new supervisory authority; the change will have to take place before the end of the Brexit transition period.”

The move comes just a fortnight after the EU Court of Justice ruled that Privacy Shield – the transatlantic data transfer pact between Brussels and the US – was invalid. At the same time, it ruled that standard contractual clauses remain valid but must be assessed on a case-by-case basis, with the data protection authority having the final say.

However, further analysis of the ECJ judgment has thrown up new threats, according to legal firm Mishcon de Reya.

In a blogpost, the company states: “Those wishing to transfer personal data out of the EU, by means of standard contractual clauses , should, at the very least, undertake a case-by-case and sufficiently detailed assessment of the transfer, and of the level of protection in the recipient country, and adopt supplementary, extra-contractual, measures and safeguards to ensure compliance with a standard of protection of personal data essentially equivalent to that in the EU.

“Failure to do so puts the parties at risk of dispute with each other; at risk of regulatory action including, but not limited to, a stopping of the transfer; and at risk of complaints and claims by data subjects.

“We emphasise the third of these: in addition to the regulatory risk, [those who] transfer data out of the EU will need to consider their risk profile in respect of private damages claims for failure to comply with the protective provisions of GDPR – there will be many data subjects wishing to pursue a damages claim.”