Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 21 SEPTEMBER 2018

Data Protection Transfers Post-Brexit

Mishcon de Reya LLP
Mishcon de Reya LLP
Contributor
Mishcon de Reya LLP

Mishcon de Reya LLP

Founded by Lord Mishcon in 1937, in a one-room office in Brixton, Mishcon de Reya now employs over...

View firm profile
Explore more from Mishcon de Reya LLP

New government guidance on cross-border flows of personal data is helpful, but serious questions remain unanswered.

European UnionPrivacy
Jon Baines
Jon Baines

New government guidance on cross-border flows of personal data is helpful, but serious questions remain unanswered.

The free movement of personal data within the European Union has been one of the bedrocks of data protection law since 1995, and the General Data Protection Regulation (GDPR) maintains this as a key objective. As the recitals to GDPR explain, such free movement contributes to economic and social progress and to the strengthening and convergence of economies within the EU's internal market.

However, since June 2016, when the United Kingdom voted to leave the European Union, a question which has concerned and vexed data protection lawyers, as well as many businesses, is what the UK's position on the transfer of personal data between EU states and a post-Brexit UK will be. In particular, a "No-deal" Brexit scenario presents immediate and pressing concerns for anyone in the UK who needs to continue receive personal data from anyone in the EU.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Ten AI Giants, One Regulator And A Lesson For Everyone Else: What The ICO’s Foundation Model Report Really Tells Us

The UK's Information Commissioner's Office has completed its supervision of major AI foundation model developers, revealing significant gaps in data protection practices and setting new expectations for legitimate interests assessments, transparency, and special category data handling. The regulator has now turned its attention to agentic AI systems, warning that autonomy is not an excuse for poor compliance and launching a call for evidence that will shape future regulatory guidance.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

To Fine Or Not To Fine: EDPB Confirms Default Position In GDPR Enforcement Should Be To Fine

The European Data Protection Board has published draft guidelines proposing a fundamental shift in GDPR enforcement: a presumption that fines should be imposed for non-minor infringements, with a deliberately low bar for establishing negligence. Organizations will need to demonstrate robust compliance programs and documented decision-making to potentially avoid penalties, as regulators move from asking "should we fine?" to "can we justify not fining?"
GlobalPrivacy
Crowell & Moring LLP
Crowell & Moring LLP
Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

Private CCTV, Ring Doorbells And Police Investigations: Where Does UK GDPR Draw The Line?

Domestic surveillance technology has evolved from simple security cameras to sophisticated smart systems that may inadvertently create legal obligations for homeowners. When does a Ring doorbell or CCTV system transform an ordinary citizen into a data controller subject to UK GDPR, and what are the implications of millions of private cameras forming an unregulated surveillance network?
United KingdomPrivacy
HCR Law
HCR Law
Article

European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down The Commission’s Guidelines On Transparency Below

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.
GlobalPrivacy
Seyfarth Shaw LLP
Seyfarth Shaw LLP
Article

UK Right To Work Checks: What Changes On 1 October 2026

The UK's right-to-work regime is undergoing a fundamental transformation that will extend compliance obligations far beyond traditional employment relationships. From 1 October 2026, businesses engaging contractors, agency workers, platform-based workers, and complex supply chains will face new liability risks that travel up entire contracting chains. Understanding these changes and implementing the required contractual terms, substitution controls, and identity verification systems is now critical for orga
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Manchester City: Independent Commission Publishes Decision On Premier League Charges

An independent Premier League Commission has found Manchester City in breach of financial rules spanning nine seasons, with findings that the club artificially inflated revenues and reduced costs by over £900 million. The decision marks what the Premier League describes as the most significant case in its history, though Manchester City strongly disputes the findings and intends to appeal, setting the stage for further proceedings that could reshape English football's regulatory landscape.
United KingdomCorporate/Commercial Law
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Meta's $18 Billion Settlement: Reckoning Or Managed Exit?

Meta has agreed to pay up to $18 billion over 10 years to settle claims by 52 US state and territory attorneys general in the largest state consumer-protection settlement in American history outside tobacco. The settlement imposes binding child-safety obligations including time limits and age assurance, but leaves the core algorithmic feed unchanged and raises questions about whether this represents genuine accountability or a commercially managed outcome.
United KingdomLitigation, Mediation & Arbitration
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

The New Trade Union Right Of Access: What Employers Need To Do Now

From 30 October 2026, independent trade unions will gain statutory rights to access workplaces - both physically and digitally - regardless of existing union membership or recognition. With tight statutory deadlines for responding to access requests and penalties reaching £500,000 for repeated breaches, employers face a significant shift in how unions can establish themselves in previously non-unionised workplaces.
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Samsung Ordered To Pay The Swatch Group US$11.6 Million In Damages For Trade Mark Infringement

The High Court has awarded the Swatch Group US$11.6 million in negotiation damages against Samsung for trade mark infringements involving watch face apps on the Galaxy App store. Rejecting both parties' extreme valuations of US$170 million and US$301, the court established important principles for assessing damages when brand owners don't license their marks and no comparable market royalties exist.
United KingdomIntellectual Property
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Renters' Rights Act 'Register Your Rental Property' Service To Launch In December 2026

The UK Government has announced the regional rollout of its new Private Rented Sector database, requiring landlords to register themselves and their properties starting December 2026. With annual fees of £65 per property and potential fines for non-compliance, this comprehensive registration system will fundamentally change how rental properties are tracked and regulated across England.
United KingdomReal Estate and Construction
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Can Insurers Avoid Covering Defence Costs Under A D&O Policy Before Fraud Is Proved?

In a landmark ruling, the English Commercial Court has determined that insurers must continue advancing defence costs under D&O policies even when fraud allegations are pending, provided a non-avoidance clause is present. The decision addresses whether such clauses violate public policy and establishes that insurers cannot withhold coverage until fraud is either admitted or proven by final court decision.
United KingdomInsurance
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

R (University Of Sussex) v Office For Students: Reshaping The OfS's Guidance On Freedom Of Speech And Academic Freedom

The High Court's landmark ruling in R (University of Sussex) v Office for Students has fundamentally reshaped how the OfS regulates freedom of speech in higher education, leading to revised guidance that requires holistic policy assessment and proper consideration of remedial actions. With the new free-speech complaints scheme now operational, institutions face heightened scrutiny of their policies and must ensure their frameworks protect lawful speech while meeting equality obligations.
United KingdomConsumer Protection
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Protecting Reputation In The AI Era: How To Prepare, Monitor And Respond

AI has fundamentally altered how reputation is shaped, with AI-powered search engines now delivering authoritative-seeming summaries rather than traditional search results. From deepfakes and voice cloning to coordinated review bombing and bot-driven harassment campaigns, the threats are evolving rapidly—but so are the defensive tools available to those who understand how to deploy them strategically.
United KingdomMedia, Telecoms, IT, Entertainment
Mishcon de Reya LLP
Mishcon de Reya LLP