Transferring EU personal data across borders is a complicated and sensitive issue. Last year’s ruling on the invalidity of the EU-US Safe Harbor scheme, and the subsequent negotiations culminating in the EU-US Privacy Shield, are testament to this. US and EU lawmakers had to scramble to agree on the terms of the Privacy Shield, which will operate as a voluntary scheme for US data importers and which some EU privacy activists may yet challenge. When the UK exits the EU, it does not want to endure the tortuous, years-long journey taken by the US in developing the Privacy Shield. But the fact is that upon Brexit, the flow of EU personal data to the UK will no longer be lawful unless the UK is assessed as having an adequate level of data protection by the European Commission (EC). And to date, the EC has only assessed 11 countries as having adequate data privacy legislation.
So the burning question in this area is: Would the UK’s data protection regime receive an adequacy endorsement from the European Commission?