TL;DR We’re taking steps to provide further clarity for EU customers post-Brexit
I’m fully aware that the last thing you’re probably wanting to hear about right now is Brexit and GDPR, but please bear with me!
When we published our Data Processing Agreement (DPA) last year in preparation for GDPR, it was widely expected at the time that a Brexit withdrawal agreement would involve the adoption of an “adequacy decision” or other similar arrangement to continue the smooth transfer of personal data between the EU and the UK post-Brexit.
Indeed, the draft withdrawal agreement for Brexit does include such a provision:
The Union shall not treat data and information obtained from the United Kingdom before the end of the transition period, or obtained after the end of the transition period on the basis of this Agreement, differently from data and information obtained from a Member State, on the sole ground of the United Kingdom having withdrawn from the Union.
As it stands, however, it appears increasingly likely that either Brexit will be delayed (by extending Article 50) or the UK will leave the EU without a withdrawal agreement in place which would make the UK a “third country” to the EU at least until a separate adequacy decision is adopted which could take longer than a year.
Article 46(2) of the GDPR does allow for a number of other options which can be put in place in the absence of an adequacy decision to ensure the protection of the privacy, rights and freedoms of EU individuals whose personal data is processed. One of these options is the use of Standard Contractual Clauses, or “Model Clauses”, provided and approved by the EU.
So, to avoid ambiguity and uncertainty for our EU customers during this time and to cater for the various Brexit scenarios we’ve decided to:
(7.2) In the event that a withdrawal of the UK from the EU results in the UK being considered a “third country” without an adequate level of data protection, the Standard Contractual Clauses included in Attachment 1 shall come into force, until such a time as an “adequacy decision” in respect of the UK (according to Article 45 of EU Regulation 2016/679) or other similar agreement between the EU and the UK is adopted.
The changes to the terms take effect from today and don’t require any action from customers. However, if you’d prefer a signed copy of the Standard Contractual Clauses, you can download a pre-signed PDF version and return your signed copy to legal@brightbox.com
If you have any questions, please do get in touch.
