Ornithology
What has Brexit to do with a small member of the bunting family? A bird that is migratory, apparently recognising no national boundaries. One that is found throughout Europe and thrives in its adopted homes in Australia and New Zealand. So widespread is the Yellowhammer (Emberiza citronella) that it has been adopted as the state symbol of Alabama.
Clearly someone in Whitehall running the No Deal contingency planning is a keen birder. Or has a sense of humour.
Political Wrangling
In extraordinary scenes this week Parliament was prorogued until 15th October. It is a move that is not without controversy and we shall see the judgement of the UK Supreme Court next week.
One of the final acts of outgoing Parliament was to pass legislation compelling Government to publish the dossier on the potential consequences of a “No Deal” Brexit, a document bearing the codename “Operation Yellowhammer”.
Extracts from the Yellowhammer report had been leaked and published in the Sunday Times a few weeks ago. Following the publication of the extracts arguments raged about the age of the Yellowhammer document and whether or not it represented a “Worst Case” or “Base Case” planning scenario.
Wednesday evening saw the publication of a remarkably matter-of-fact 5-page Operation Yellowhammer document with the status “Official Sensitive”. The report is dated 2nd August and it apparently represents the Government’s “Reasonable Worst Case Planning Assumptions”.
Implications for UK Companies receiving Personal Data from EU
Under the general heading “Key Planning Assumptions” are sections on the widely discussed impacts on HGVs entering the UK particularly at the Channel ports and disruption to the supply of fresh food and medicines.
Listed at Number 9 (of 20 assumptions) is the following:
“The EU will not have made a data decision with regard to the UK before exit. This will disrupt the flow of personal data from the EU where an alternative legal basis for transfer is not in place. In no deal an adequacy assessment could take years.”
This is an important consideration for companies in their No Deal contingency planning. Under the No Deal outcome, the UK becomes a Third Country and would no longer be covered by EU ‘free flow of data’ rules.
As the Yellowhammer report states the UK would need to apply for an adequacy decision to ease the flow of personal data from EU member states. Typically, an adequacy assessment from the EU can take 2 years – sometimes longer.
To date the EU Commission has adopted 13 adequacy decisions with: Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, and the United States (for companies using the EU-US Privacy Shield or Swiss-US Privacy Shield). Most recently the EU agreed a reciprocal adequacy decision with Japan. South Korea started the process of applying for an adequacy decision from the Commission in 2015. The decision is still awaited.
What to do?
The previous blog (“55 Days to Go”) covers the steps that UK companies need to take when handling data from EU member states.
Privacy Notices
Companies must also review and update Privacy Notices to include amongst other items:
- The legal basis for processing personal data
- Collection and use of personal data for direct marketing, analytics, research purposes – where applicable
- Collection of HR personal data
- Transfers of personal data outside the EEA and the transfer mechanisms in place to govern those transfers
What Next?
An update on the August version of the Yellowhammer report which will include the current contingency plans in the case of a No Deal Brexit has been promised. It will be interesting to see if any progress has been made on the status off data flows in recent weeks.
Meanwhile the Government continues to insist its preferred outcome from the Brexit negotiations is a deal with the EU. If a deal is secured it may be that the current flows of personal data to and from the EU are not materially affected.
Watch this space.
Please feel free to contact us if you have any queries or concerns about how Brexit will affect your business, by calling 01787 277742 or email teambrexit@datacompliant.co.uk
Gareth Evans, 12th September 2019