Categories

Does the Brexit deal change how you handle data in your VA business?

Brexit dealHow does the Brexit deal change how you handle data in your VA business? 

We had a ‘business as usual’ arrangements in place that would have expired at the end of 31st January 2020.  The Brexit deal means that this continues until 30th April or 30th June (unless either party objects or we get a ‘finding of adequacy’ on how the UK handles personal data.   This requires no short term changes to UK data processing laws that would bring the UK out of alignment with GDPR.

It is up to the EU to make that determination and there is no provision for the UK to appeal (or any other country).   The UK has already unilaterally provided that transfers of personal data from the UK to the EU do not require changes or additional processes.   It is the transfer of data back from the EU which may change.
Remember that viewing data on EU citizens that is collected by your non-UK clients is ‘processing it’.  You do not have to edit or change the data for this to apply.

What do you need to do as a result of the Brexit deal?

If you are already using KoffeeKlatch global contracts you need to:
  • work out if you think your contract will be in place after April 30th or June 30th
  • if it is due to end before April 30th you can use the global contracts without the additional model clauses for data processors in 3rd countries without a finding of adequacy
  • if it is due to end after April 30th you need to decide whether to issue the full pack (and make no changes in April or June) or issue the shorter version and issue the supplemental elements on April 30th or June 30th (or some other date in between) if a determination is made.
If you have contracts that involve handling EU Citizens data in the UK during this period (or beyond) your Global contracts are set up for all eventualities.
If you are not already using KoffeeKlatch global contracts you will need to go through the same process, but also review or amend your contracts as necessary to include the relevant clauses.   We are still coming across people using contracts that were not properly set up for the GDPR changes in 2018, so you need to be careful you do not simply cut and paste or copy contracts or terms from other people. If you are copying something that is wrong, it will still be wrong when you use it.  And of course, all those contracts will be someone’s copyright and if you have not paid or been given the right to use that contract by the person who wrote it, you will be breaching their copyright.
If you’d like to know more about our VA Global contracts you can find them here.
If your clients are all in the UK you will not need to make any changes at this point, but it is still a good idea to make sure you are complying with UK data privacy laws rather than ignoring them as other changes are coming for a variety of reasons.

What is a data adequacy decision?

The Brexit deal does not deal with GDPR beyond the provision for extension.  The plan is for the UK to get a ‘finding of adequacy’ which means the EU Commission will decide this on its own.   As long as our data laws remain in line with the EU that is likely.  But it is possible that the UK will decide to deviate from EU law and it is not a foregone conclusion that any new regime will be found to be ‘adequate’

You may remember that at one point it was OK to send personal data to USA organisations who were relying on the USA Data Privacy Shield.   Now it is not in EU GDPR terms.  Their original finding of adequacy was changed later on as a result of what is known as the ‘Shrems decision’ or ‘Schrems II’.  This was a decision by the European Court of Justice that the USA Data Privacy Shield did not provide adequate protection for personal data.

So a finding of adequacy is not necessarily permanent!

This did not mean that you could not store data in servers based in the USA, but it meant that the contractual and security processes needed to do so had to be updated.
You have probably had a lot of ‘notification of contractual changes’ from your software providers which are making this switch.  You will also be getting some saying they are moving from EU servers to USA ones.

What does the Brexit deal mean for you?

You will need to do more than review your contracts.  You will also need to review your data processing policy so make sure it is clear where you are storing data.   This is something you need to do whenever there are changes as a data privacy policy is never something you just have and ignore.  It has to change as your business changes and as the legal framework changes.

You will also want to review how you collect and use ‘special category data’ since there may be implications about the changing locations of your data that you will need to bring to your customer’s attention, or you may need to update consent forms.

Does the Brexit deal change how you handle data in your VA business? 1

Is Brexit making your headache?

Here at KoffeeKlatch we’ve been thinking and planning for several possible Brexit deals over the last few years.   From sorting out your GDPR   to creating a range of global contracts designed to help you build your global future, we have been working as hard as we can.   We did a lot of thinking and worrying and planning – so you don’t have to worry about these things.   We have got your covered.

In a world full of uncertainty and change, why not relax and have a cup of coffee – there’s one less thing to worry about.

 

 

 

 

 

Drop us a comment

Leave a Reply

AUthor

Annabel Kaye

Annabel Kaye

All Posts

related posts

Bestselling Contracts and Support for a Range of Industries

The perfect business contract protects more than just your boundaries. The perfect business contract protects your clients in relation to things like Copyright, IP, GDPR, scope-creep and all the other things that eat away at your profitability.

Check out our contract shop and GDPR support today and start earning what you should in your business.

Shop Contracts