Brexit - Belgium hard brexit law - Data protection

The Brexit law does not contain any specific provisions on data protection or, more specifically, the transfer of personal data from Belgium to the UK, in the event of a ‘hard’ Brexit. In the event the UK would leave the EU without a transitional arrangement, the implications for international data flows and privacy compliance in general will nevertheless be severe.

On 12 February 2019, the European Data Protection Board (EDPB) issued an information note on data transfers under the GDPR in the event of a no-deal Brexit.

When the UK exits the EU without a deal, the UK will automatically be regarded as a country that does not provide adequate protection of personal data originating from the EU. In price, this means that EU entities transferring personal data to the UK must ensure that:

• Prior to Brexit, appropriate safeguards are put in place; or
• In the absence of appropriate safeguards, the transfer of personal data after Brexit can be based upon one of the derogations provided for in Article 49 of the GDPR.

Appropriate safeguards may consist of:

• Standard Contractual Clauses (SCC) adopted by the EU Commission;
• Ad hoc contractual clauses, to be approved (case-by-case) by the Belgian Data Protection Authority, following an opinion of the EPDB;
• Binding Corporate Rules (BCR), to be approved (case-by-case) by the competent national supervisory authority, following an opinion of the EPDB; or
• Codes of conduct and certification mechanisms, a new tool under GDPR for data transfers, of which currently no concrete examples exist.

In order to prepare for a ‘hard’ Brexit, Belgian entities should take the following steps:

• Identify what processing activities will imply a personal data transfer to the UK;
• Determine the appropriate data transfer instrument for their situation;
• Implement the chosen data transfer instrument to be ready for 30 March 2019;
• Indicate in their internal documentation that transfers will be made to the UK; and
• Update their privacy notices accordingly to inform individuals.