Ms Helen Dixon:

The question is very clear. As Senator Ó Donnghaile is aware, data protection law starts out with a prohibition on the transfer of personal data of EU persons outside of the EU, as will future law under the GDPR. The obvious consequence of Brexit when it happens is that the UK will become a third country for the purpose of the transfer of data, which is what the Senator has referenced. As Mr. Carroll outlined, in circumstances where the UK is no longer implementing the GDPR and is no longer party to it, it remains to be seen whether it will retain an equivalent set of standards, something that effectively mirrors the GDPR. In these circumstances, we anticipate the UK would apply for an adequacy finding of the EU Commission. As Senator Ó Donnghaile knows, once the EU Commission makes an adequacy finding in respect of a third country it effectively covers transfers, subject to ongoing review by the EU Commission that it is retaining the standards. The ultimate solution is that the UK would retain laws equivalent to the standard under the GDPR and the EU Commission would make an adequacy finding.

If it is the case the Commission does not make an adequacy finding there will be costs for business in terms of legitimising the transfers of personal data between Ireland and the UK, because one of the legal mechanisms provided for under the law would have to be implemented to effect the transfers. The types of legal mechanisms provided for are binding corporate rules or standard contractual clauses. These are means by which an entity can adduce adequate safeguards, as it is described in the law. There is a legal cost to implementing these types of mechanisms. It is the case that transfers will be capable of being affected post-Brexit, but it remains to be seen as to whether this will have to be achieved with a cost to business in terms of how it will implement the transfers.