Does your business take data from European counterparts? Time may be running out to put in place alternative arrangements for those data transfers as the prospect of a "no deal" Brexit looms larger.

In their report “Response to the vote on the Withdrawal Agreement and Political Declaration: Assessing the Options” published on 28th January 2019, Parliament’s Exiting the EU committee expressed concern about the failure properly to prepare for a no deal Brexit at both a governmental and a business level. One of their areas of focus was data protection.

Under a no deal Brexit the UK will instantly become a third country for data protection purposes. In the absence of an adequacy decision from the EU Commission (which is not provided for in their no deal contingency planing) or a separate bilateral agreement (such as the Privacy Shield arrangement between the US and the EU) this means that one of a number of alternative mechanisms for data transfers must be adopted. All of these are problematic.

Some companies with EU group companies may already have a set of Binding Corporate Rules in place, providing a standardised framework for data transfers. Putting those in place at this stage, though, would be both costly and time-consuming. 

Other businesses might choose to contract on the EU Commission’s model contractual terms for data protection. These terms, while not unduly onerous, are extremely inflexible. The contract between the parties may include additional provisions specific to their engagement, but the model clauses themselves cannot be modified or deleted.

Without adopting one of these solutions, though, companies will be left in the unsatisfactory position of asking counterparts to effect data transfers on a case by case assessment of compliance, with the risk on the transferring entity. This will seldom be attractive to the counterpart.

As the committee say in their report, these “alternatives are cumbersome, time consuming and would place a bureaucratic burden on individual businesses.” But, as they go on to say: “In the event of a no deal Brexit, with no arrangement on data in place, those wishing to transfer personal data between the EU and the UK would have to explore such alternatives.”