While you can’t plan for uncertainty, you can prepare for it. The Advertising Association is encouraging the industry to plan for Brexit as the risks of the UK leaving the EU without a deal on 31 October 2019 are high.
In its remit of representing the interests of the UK advertising industry, the Advertising Association has brought together key pieces of information to ensure businesses have contingencies in place to continue receiving personal data lawfully in the event of a no-deal Brexit. This is intended to provide guidance, and does not replace legal advice.
The UK’s data protection regime is currently governed by the EU’s General Data Protection Regulations (GDPR) and the UK’s Data Protection Act 2018 (DPA 2018). If your organisation receives personal data from the EEA you will still need to abide by both GDPR and the DPA 2018 even after Brexit.
Assessing data adequacy
As the UK is currently a member of the EU, there are no restrictions on the flow of personal data and other EEA Member States. Article 45 of the GDPR states that the European Commission needs to assess the relevant country’s laws to determine whether they are essentially equivalent or “adequate” to that of EU ones.
Data Protection Lead Authority
If the ICO is your lead Data Protection Authority, you may need to review your operations to assess whether you can still have a lead authority and benefit from the one-stop-shop following Brexit.