Brexit could have a bigger impact on European companies than recently expected because the existing legal foundation for secure data traffic will expire after Brexit and respective agreements to fill this hole still have to take shape. Such an interpretation could at least be made due to a statement by the European Commission from 9th January, 2018, according to which the United Kingdom will become a third-country and there is no underlying adequacy agreement which would guarantee data protection in this case.
The reason for this statement could have been a surveillance law that the British government passed in November of 2016 and which is one of the most comprehensive surveillance bills in the European Union. Similar regulations have already thwarted the Safe Harbor Agreement between the USA and the EU. It is apparent that the UK is interested in an adequacy agreement as well, as can be deducted from a message of the House of Lords in July 2017, in which concerns are expressed, as to how useful British data protection measures are and demands are made to secure data protection for the coming Brexit.
What will happen after Brexit?
It is easy to foresee what impact these developments might have for European companies. At the latest after Brexit, the UK will not be used as a data harbour any longer. Companies that will still want to do data transfers to the United Kingdom, will need certain reassurances that data protection is still in place. The matter will get more difficult if after Brexit the Privacy Shield Agreement will not be valid for the UK anymore and therefore data transfers between the UK and the USA will not be subject to regulation.
It is still unknown if you have to rethink your data traffic until a possible Brexit in March 2019 in order to avoid respective fees. Therefore you will have to look forward to the presentation by Elizabeth Denham, Information Commissioner UK, at the EDPD 2018
“A new regulatory chapter for (UK) data protection – what to expect from a regulator with an international outlook.”