Firms urged to set up their own EU data transfer deals

With just six months to go before Brexit comes into force, the Government is now advising firms to draw up their own contracts for transferring data between the UK and EU countries – as well as the US – despite warnings that without an interim deal the UK’s £240bn data economy could fall off a cliff edge.
In the first sign that the Department for Digital, Culture, Media & Sport (DCMS) is bracing itself for a “no deal” Brexit, it encourages organisations to look to the Information Commissioner’s Office for further guidance and practical support on the issue. However, the ICO is still in the process of preparing this guidance, but insists it will be available “shortly”.
The issue is further complicated by the fact that once the UK leaves the EU, firms – including the likes of Acxiom – will no longer be covered by the US Privacy Shield deal.
Led by the CBI, British businesses and industry bodies issued their first warning back in September 2017, underlining the importance of rapid agreement to ensure that the exchange of data with the EU can continue smoothly after March 2019.
To seek an adequacy decision, a country must already be outside of the EU, and historically adequacy decisions have taken up to four years to be granted.
Now, the DCMS is encouraging organisations to be ready to consider the adoption of standard contractual clauses (or other appropriate transfer arrangements) in the event of a “no-deal” Brexit.
Leading law firm Pinsent Masons, however, also recommends that businesses begin reviewing their contracts to see whether there are clauses which prohibit transferring personal data outside of the EU and take steps to address this. The firm says it will also be important to review privacy notices to consider what data subjects understand about the movement of their personal data inside and outside of the EU and amend as appropriate.
Anna Flanagan, an associate solicitor in the information law team at Pinsent Masons, said: “If the flow of personal data in and out of the EU is interrupted for even a short period, the impact on organisations will be seismic.”