The two year withdrawal period which began when the UK notified its intention to leave the EU under Article 50 of the Lisbon Treaty expires on 29 March 2019.
With the UK Parliament having twice rejected the withdrawal agreement reached by the two sides’ negotiating teams, Theresa May’s government has asked for an extension of the Article 50 period until 30 June 2019.
However, the president of the European Council, Donald Tusk, indicated in a statement on 20 March 2019 that the EU would be unlikely to agree to the extension unless the UK Parliament first votes through the withdrawal agreement.
Thus, if there continues to be no majority in the UK’s House of Commons for the negotiated withdrawal agreement and the EU27 uphold the position outlined by Mr. Tusk, it appears the UK will leave the European Union on 29 March with no agreement in place.
Such a "no-deal" departure would have significant consequences in multiple commercial areas for businesses involved in trade between the EU and the UK.
As regards data protection, the immediate consequence would be that Britain would become a "third country", not recognised by a European Commission "Adequacy Decision". This would mean that organisations transferring personal data (of clients, prospects, employees, etc.) from the EU to the UK would find themselves in breach of the prohibition on data transfers to third countries under GDPR article 44.
In such circumstances, the actors involved would need to implement appropriate safeguards pursuant to GDPR Article 46 in order to enable continued legal EU to UK data flows. In practice, given the short timeframes involved, this is likely to mean the signature of the European Commission’s standard data protection clauses between the European entity sending the data and the UK entity receiving it.
Altij's data protection team would be pleased to help you put the appropriate measures in place and to assist you with any other Brexit-related questions as regards doing business in France.
Nicholas Cullen is a dual-qualified Solicitor of England and Wales and Avocat in France. He is a member of Altij's data protection team. For more information about our GDPR offer see our dedicated website: https://www.conformite-rgpd.expert or contact us via our online form.