In the wake of no-deal Brexit headaches, a number of international groups ask for advice on cross border transfers and how to make the best decisions when establishing a data center.
If a company locates its data center in a EU country (ie in perspective, not in the UK), the flow of personal data from the EU to UK (which will be considered after Brexit a “third country”) will be authorized only in presence of an adequacy decision of the European Commission or in presence of other safeguards.
The EU Commission at the moment has stated that if it will deem the UK’s level of personal data protection essentially equivalent to that of the EU, it will make an adequacy decision allowing the transfer of personal data to the UK without restrictions. However, the European Commission has not yet indicated a timetable for this and it also stated that the decision on adequacy cannot be taken until UK is a third country.
If the European Commission does not make an adequacy decision regarding the UK before or at the moment of exit, a legal basis for transfers from EU to UK must be identified. In this respect it must be noted that European Commission has not yet released the new standard contractual clauses (the clauses released under Directive 95/46 can however still be used) and that the binding corporate rules (“BCR”) must be approved by the competent authority and this approval may take some time.
These two instruments (standard contractual clauses and binding corporate rules), which are the most used for cross border transfers, are different and must be used in different contexts, so the specific situation must be assessed.
Setting up a data center in a EU country rather than in the UK (e.g. in Italy) could have some advantages – the most appropriate instrument for cross border data transfers will then have to be assessed.
Milan, 23 January 2019
This note is for information purposes only and it is not to be intended as legal advice. For any further information or to receive advice tailored to your situation, please contact us.
