It appears as though the chances of a hard Brexit have steadily increased over the past few weeks. While the chances of hard Brexit happening are still only rated at between 10 and 20%, the implications for data handling are clear enough.
Without a deal, the UK will be what is known as a “third country” by the end of March 2019. The UK will exist outside of the EU and the EEA.
Which means there is a risk there will be no lawful basis for EU based businesses transferring personal data of EU citizens into the UK. The UK will also have no lawful basis for transferring personal data to the US, as we currently rely upon the EU/US Privacy Shield to do so. If we’re not in the EU, Privacy Shield is no longer valid.
A “deal” hopefully means we can continue to process personal data in much the same way as we do today. The prospect of “no deal” raises the possibility of EU based online travel agents having no lawful basis to transfer reservations data to UK hotels.
(I appear to be the only person talking about this. People keep telling me there’s nothing to worry about. I prefer to at least have thought the problem through, so if it does happen I’m not guessing).
All those reservations you’re hoping to get from Booking.com for next season? Booking.com is a Dutch company. They are in the EU. The risks seem pretty clear to me.
Of course, there are ways of dealing with the problem using a system called “Standard Contractual Clauses” (SCC). However in a world where many hotels haven’t even got their website privacy notice right, I am not filled with hope they will be able to apply themselves to this.
Let us all hope for some sort of deal which can protect our national status as a leader in personal data processing and privacy protection. The implications of no deal are serious.
Don’t just take my word for it, even the Daily Express is writing about it (and seeking the input of the marvellous Direct Marketing Association in doing so) – https://www.express.co.uk/news/politics/1033309/no-deal-brexit-explained-what-does-no-deal-brexit-mean-for-data-rights