The last date for the United Kingdom to leave the European Community was set for January 31, 2020. In any case, if it is going to be the final date remains to be seen.
As we already know, Brexit will generate serious problems in the legal field, especially if we are faced with a hard Brexit, that is, an exit from the United Kingdom without an agreement. One of the relevant issues is the protection of personal data, which can have a great impact on the Balearic Islands for companies in the tourism and hotel sector, among others.
Among other complications, it could entail changes in the matter of transfers of personal data between Balearic companies that have commercial relations with the United Kingdom, or vice versa. In this sense, these companies should carry out an internal audit on data protection, following the steps of the information note of the European Data Protection Committee (CEPD):
1.- Identify the processing activities that involve data transfer:
First of all, we must know that the transfer of data from the UK to the EU will not pose any problem. However, with a hard Brexit, the transfer of data from the EU to the UK would mean it, as the UK would be considered a third state without the correct level of adequacy. Which would imply a much higher level of bureaucracy for transfers.
2.- Determine the instrument for adequate data transfer:
In the above case, the affected companies must adopt any of the data transfer mechanisms that guarantee compliance with the security measures and protect all the rights of the interested parties. For example, we can draft standard or ad hoc data protection clauses approved by the European Commission, apply codes of conduct enforceable to those responsible and in charge of personal data, sign contracts of bilateral agreements on data protection, or elaborate binding corporate standards or policies.
3.- Start the data transfer instruments before departure:
Having chosen the most appropriate instrument to continue transferring data, the necessary modifications and updates must be made in the contracts and agreements already signed in relation to the exchange of personal data with suppliers, collaborators, or even affiliated companies.
Therefore, it is vitally important that Balearic companies that have commercial relations with the United Kingdom prepare for their departure. And in terms of personal data, to ensure how they will be able to continue making these data movements between one region and another.
