By Jocelyn S Paulley
In a post-Brexit world where the UK is no longer part of the European Economic Area (“EEA”), the UK will be a ‘third country’ from the point of view of international transfers of personal data, and hence have to satisfy one of the grounds on which such transfers can be made in the GDPR. This issue has been consistently high on the government’s radar as one which the government needs to reach agreement on with the EU both to facilitate cross-border business and data flows post Brexit, but also to retain the Information Commissioner’s (regulator of the GDPR in the UK) seat at the table of the European Data Protection Board, the body of European data protection regulators who are at the heart of developing guidance, practice and law for data protection.
On 23 May, the government issued a proposal to the EU for a new model of Data Protection Agreement. The UK wants to build a ‘new, deep and special partnership with the European Union’, which goes further than the standard adequacy position.
