Mr. Seamus Carroll:

I thank Senator Ó Donnghaile. That is a really interesting and pertinent question. The position is that the UK will already have given effect to the General Data Protection Regulation and the directive prior to Brexit. At the point of Brexit, the United Kingdom will be compliant with EU data protection law. Then, on leaving the EU, the United Kingdom will no longer be a member state. In that case there is a mechanism that is called an adequacy finding. This is based on a European Commission decision. We have heard about this in the past with regard to the safe harbour decision and, more recently, the privacy shield. Adequacy decisions already exist for Canada, New Zealand, Israel and numerous other third countries. Basically, it means that where the data protection arrangements of those third countries equate with those applicable within the member states, then transfers of personal data across borders can continue without hindrance.

A difficulty would arise if the UK were to adjust data protection standards post-Brexit. That would certainly raise the question of whether the applicable data protection standards within the UK were still at the same level as the EU standards. On the understanding and the assumption that UK data protection standards would remain equivalent to those in the European Union, one could expect an adequacy decision of the European Commission - which is provided for in the regulation - that would permit continued unhindered transfers of personal data into and out of the United Kingdom to the EU.