Ms Nicola Coogan:

I will deal specifically with companies that need to continue transfers in the event of there being no adequacy or some kind of delay in adequacy measures such as the standard contractual clauses which we mentioned. In theory, standard contractual clauses are an off-the-shelf arrangement that can be appended to the data protection contracts that companies should have in place as processes, for example. However, the judgment of the court has made that slightly more complex because that assessment has to be done and the companies have to decide if there is a gap in the level of protection within the UK, if we are talking about the Brexit scenario, that they need to put in place supplementary measures.

As Mr. O'Dwyer stated, the EDPB has published guidance on supplementary measures. There is quite a lot of detail. There was a huge level of interest in the public consultation and we have been going through the submissions and assessing if more needs to be done. If I was advising a company on what to do in the first instance, I would say to look at the transfer and see if it needs to continue to the UK. If that is the case, they need to look at whether standard contractual clauses are appropriate or if any of the derogations apply. It is unlikely in a commercial transfer that they could apply, for example, in an ongoing arrangement such as a payroll scenario. The companies would need to do an assessment to determine if there was an issue regarding access to data by law enforcement and what kind of additional measures to employ such as encryption, anonymisation or whatever else. Some examples were given in the original supplementary measures guidelines which might be of assistance in the first instance.