Articles 70 – 73 of the draft Withdrawal Agreement address the impact of Brexit on Data Protection and the free flow of personal data between the UK and the EU.
As anticipated EU Data Protection Law will continue to apply in the United Kingdom during the transition period including in relation to the free flow personal data between the EU and the UK and visa versa.
The draft Agreement anticipates that the UK will provide an adequate level of protection for personal data to ensure that it is given equivalency with the remainder of the EU. There are a few other notable points:
- During the transition period, the CJEU will have jurisdiction
- The ICO can, during the transition period, attend (by invitation) meetings of the EDPB, but will not be able to vote (i.e. observer status)
- The draft political declaration outlines a commitment to start adequacy proceedings, for the EU Commission to adopt an adequacy decision in respect of the UK by the end of the transition period
For the time being, therefore, in relation to the EU General Data Protection Regulation and the protection of personal data the position is “situation normal” although much more clarity will be needed in due course.