Overview of post-Brexit data transfer

Overview of post-Brexit data transfer

• Unless the UK government changes its current stance, there is no issue with Union Street transferring data outside the UK to the European Economic Area (EEA).
• The UK does not, however, have an adequacy agreement for data coming into the UK from the EEA, and it is unlikely to get one before January 2021.
• This essentially means that when the UK leaves the EEA and is reclassified as a ‘Third Country’, the EU will no longer automatically consider the UK’s data security practices to be sufficiently rigorous. Further safeguard will, therefore, be required to allow the transfer of data from the EEA to the UK.
• There is a straightforward mechanism in European law which can be used to resolve this issue called Standard Contractual Clauses (SCC). This is a data transfer agreement for both parties to sign and agree to follow. This, in essence, confirms that all safeguards required by the GDPR are in place between the two companies, allowing data transfer to continue as it does now after the UK leaves the EEA in January 2021.
• In order to ensure that any service Union Street provides now or in the future is compliant, we are completing SCCs with all customers so that business can continue as it does now.

 

What changes are there to how we do business?

• There will be no change to your services as a result of Brexit. All existing services that you may have chosen, including Union Street’s hosting and bureau services, will continue as they are now.
• There will be no changes to existing information security. Union Street has not removed or omitted anything as a result of Brexit and will continue to protect your data as it does now.
• Rather than data transfer being governed by the GDPR, once the UK leaves the EEA, data transfer between Union Street and its customers will be covered by agreement to follow the Standard Contractual Clauses.

 

Will we need to consider changing the Standard Contractual Clauses?

• The Standard Contractual Clauses are only valid if the existing clauses are not altered whatsoever, so no changes have been made to them, nor will there be any need to do so.
• While it is permissible to add additional clauses that do not contradict the existing clauses by mutual agreement, none have been added or will be added. The purpose of completing this agreement is to ensure we can continue to legally transfer data as we do now in 2021.
• Should you wish to discuss contract revisions of your current contract, please contact your Customer Success Manager who can arrange to do so with you as a separate matter.

 

What do I need to know to fill out the required details?

• We have tried to complete as many details as we reasonably could to reduce what you need to do and simplify the process. We’ve also tried to keep the agreement’s details flexible so that if in the future you choose to use additional services from Union Street, hosting or bureau services for example, you’re able to do so.
• Regarding the agreement’s terminology, please note that you are the Data Exporter sending the data as the Data Controller. Union Street is the Data Importer receiving the data as the Data Processor.
• Your will need your company name and address details including telephone number and company number. (Company number is not mandatory but it is helpful to identify a company even if it has changed its name and address).
• The person who completes this agreement for the Data Exporter (you) needs to be the same throughout the entire document and, where appropriate, this should include the full name of the person signing.
• Where the law that the contract falls under is required, it must always be the Data Exporter’s country and cannot be any other. For the United Kingdom this will be either “England and Wales”, “Scotland” or “Northern Ireland” as appropriate (Clauses 9 & 11).