The Transfer of Personal Data from the European Union to the United Kingdom post-Brexit

Abstract

The transfer of personal data to the UK raises a multitude of data protection law issues and opens up the view of the key challenges of global data exchange. The study contains an overall view of the regulations on third country transfers under the GDPR and the current state of regulation in the UK. It provides an assessment as to whether and to what extent the UK provides an adequate level of protection within the meaning of the GDPR for personal data transferred from the EU and whether the EU Commission's adequacy decision under the GDPR is compliant with the CJEU’s relevant case law. The examination of the UK’s data protection law as well as the regulations of the Investigatory Power Act and the extensive onward transfer practice to the USA form a main focus of the study. The alternative data transfer mechanisms and bases (Articles 46, 47 and 49 GDPR) are (also) examined with regard to their practicability for companies. The study also looks at relevant emerging developments and the wider context of the third country regimes of the EU’s data protection regime.