31 January, 2020
As the UK prepares to leave the European Union on 31 January 2020, the Information Commissioner's Office (ICO) has released a statement confirming that it will be "business as usual for data protection" during the transition period.
The Brexit transition period will run until the end of December 2020 and during this period GDPR will continue to apply. Therefore, organisations will not need to make changes to their existing data protection compliance solution.
Looking ahead to the end of the transition period, it is not yet confirmed how the UK will ensure the free flow of personal data across the EU. At the end of the transition period, the UK will become a "third country" for the purposes of the GDPR and this will impact the transfer of personal data outside the UK.
The Government has confirmed that once the UK leaves the EU, the European Commission will start the process of recognising the UK's data protection laws as adequate. This is known as an 'Adequacy Decision' and will allow personal data to be transferred from the EU into the UK as if the UK were located in the EU. If an Adequacy Decision is granted to the UK this will simplify the issue of international transfers of personal data at the end of the transition period. However, it is yet to be seen whether the European Commission will grant the UK an Adequacy Decision and, even if one is granted, the decision is subject to periodic review and can be revoked.
For the meantime, no immediate action needs to be taken and organisations should continue to follow existing guidance published by the ICO. The full statement published by the ICO can be found here.
For more information contact Bethany Paliga in our Governance, Procurement & Information department via email or phone on 01254 222347. Alternatively send any question through to Forbes Solicitors via our online Contact Form.