Data Protection & Brexit

Transcription

1 Data Protection & Brexit The implications for Irish business Gordon Wade, Solicitor KPMG Legal Services September 2017

2 Background Brexit has implications for many aspects of Irish business EU economy thrives on the free flow of information across borders Value of EU citizens' personal data estimated to grow to nearly 1trn annually by

3 Data is the new currency Personal data has become a highly valuable asset. The market for analysis of large sets of data is growing by 40% per year worldwide. The currency of this new digital economy is data and in many cases personal data. Commission valued the EU data economy at 272bn in 2015 Estimated value could rise to 643bn by 2020 Viviane Reding, VP, European Commission,

4 Why Data Protection? ü ü ü ü Irish companies own more than 1,200 large UK businesses, with a combined turnover of 37bn in 2015 Irish business can currently transfer Personal Data to the UK freely Core tenet of EU data protection law is the control of extra-eu cross border data flows Any third country outside the EU should be subject to strict legal controls 4

5 General Data Protection Regulation GDPR will become the data protection law for Europe on 25 May 2018 Post-Brexit UK will be considered a third country and will no longer automatically maintain free and uninterrupted data flows with the EU Importantly, will pre-date the Article 50 exit process Any transfers of personal data will be considered to be a transfer outside the EEA 5

6 UK Government position At the point of our exit from the EU, the UK s domestic data protection rules will be aligned with the EU data protection framework. - UK Government The Exchange and Protection of Personal Data: A Future Partnership Paper UK Government - committed to maintaining the stability of data transfers between the EU and UK post-brexit Drafted a Data Protection Bill 2017 to give effect to the GDPR in English law

7 Post-Brexit Data Transfers Methods Commission adequacy finding Norway Model - EFTA/EEA arrangement Swiss Model - Bilateral Trade Arrangements 7

8 Potential Alternatives 1 EU Standard Contractual Clauses (SCCs) 2 EU Binding Corporate Rules (BCRs) 3 Bi-lateral agreement NOTE: Implementing SCCs or BCRs can be costly and complex for Irish businesses and any bi-lateral agreement would need both EU and UK approval

9 Outlook Landscape remains uncertain but adequacy decision looks to be the way forward But Decisions at the political discretion of the Commission Article 45, GDPR mechanism for periodic review of decisions every 4 years 9

10 Potential Implications Transfer of data in breach of the GDPR - fine of 4% of global turnover or 20m, whichever is higher UK businesses still bound by the GDPR post-brexit if they sell goods or services into, or monitor individuals in, the EU 10

11 Brexit & Data Protection ü Brexit data flows will be resolved at some stage Businesses should not panic about the impact of Brexit on data protection law Short term GDPR will be the law of the UK so data transfers will be lawful Long term Irish companies operating across multiple jurisdictions should continue to prepare for the GDPR To future proof things, better to locate data in Ireland / EEA rather than in the UK 11

12 Thank you 12