In a Notice to Stakeholders, the EC’s consumer directorate has stated that the UK will be considered a “third country” as soon as it leaves the EU, and citing “considerable uncertainties”, the notice said that all stakeholders processing personal data are reminded of the legal repercussions that need to be considered when the UK leaves the EU.
And Eduardo Ustaran, a partner and European head of data protection at law firm Hogan Lovells said: “Reading between the lines, the EC’s notice basically says that the UK should not count on ‘adequacy by default’ and that all is subject to a wider political agreement."
Ustaran also believes the note is essentially a warning to the UK Government and businesses of the obvious consequences of not reaching a Brexit deal that covers data protection.
“As inevitable as the consequences are, it is slightly chilling that the Commission is pointing out that if no adequacy decision is made, the UK will join the countries not regarded as safe for EU data,” he said.
The Confederation of British Industry long warned of the consequences of the UK having "third country" status, fearing that the UK’s £240bn data economy could fall off a cliff edge.
Deputy director-general Josh Hardie recently said that the Government had taken the right steps by introducing the UK Data Protection Bill and committing to GDPR, however, he added: “Adequacy is the gold standard for data flows and is proof that a country has a business environment that really protects data. But unless the Brexit negotiations find another way, getting such a deal would mean first becoming a ‘third country’. In other words, we’d need to leave the EU before that process could even begin."