Brexit - The Impact On Personal Data Flows Between The UK, US, EU/EEA

A. Summary

On January 31, 2020, the UK will cease to be a member of the European Union and European Economic Area (EEA).¹As a consequence:

• The EU's General Data Protection Regulation (GDPR) will continue to apply, in particular to entities established in the post-Brexit EEA or established outside the EEA, but targeting individuals there. The GDPR will, however, cease to apply to similar activities conducted in UK.
• Brexit therefore complicates transfers to the UK from the EEA, since following the UK's departure from the EU, such transfers will become "international transfers" and, as such, depend on specific legal bases set out in the GDPR.
• The UK will maintain the current rules for transfers from the UK to the EEA. UK entities may require local representation in EEA countries and EEA entities may require such representation in the UK.