Question to the Department for Digital, Culture, Media & Sport:

To ask Her Majesty's Government what data sharing measures they have considered for UK and EU companies whose commercial model requires such sharing in the event of a no-deal Brexit.

It is in everyone’s interests that the unrestricted exchange of personal data between EU Member States and the UK continues. The EU has an established mechanism to allow the free flow of personal data to countries outside the EU, called adequacy decisions. The EU has committed in the Political Declaration to the Commission beginning its adequacy assessment of the UK as soon as possible after the UK leaves the EU, endeavouring to adopt adequacy decisions by the end of December 2020 if the applicable conditions are met.

The UK has already taken steps to ensure that, if adequacy is not secured, there will be no additional restrictions on transfers of personal data from the UK to the EU.

In addition to adequacy decisions, there are a number of alternative mechanisms which allow the legal transfer of personal data from the EU to a third country. The most common alternative transfer mechanism for companies is standard contractual clauses (SCCs). SCCs are pre-approved by the European Commission and can be inserted into contracts to provide a legal basis for transferring personal data from the EU to a third country.

We are working with the Information Commissioner Office (ICO) to raise awareness and help businesses comply with the rules when we leave the EU. The ICO has produced guidance and resources for organisations, which can be found on the ICO's website at www.ico.org.uk.