(Photo: Shutterstock.com) (Photo: Shutterstock.com)

As the deadline for the United Kingdom to leave the European Union looms with no deal in sight, data privacy attorneys said many are taking a wait-and-see-approach over how they can transfer data between the U.K. and EU after Brexit. 

To be sure, even if the deadline passed without a withdrawal agreement approved by the U.K. Parliament, the U.K. would still be subject to the General Data Protection Regulation until Dec. 31, 2020, when the country would officially leave the bloc. 

“EU-originated personal data will go without any formal restriction to the U.K. during that 21-month grace period,” said Gabriel Voisin, a London-based Bird & Bird partner. 

The 21-month transition period, Voisin added, could be used by the U.K. Parliament and EU lawmakers to hash out an agreement that ensures the U.K. policy meets EU data protection standards. In contrast, the U.K. has already agreed the EU member states' data protections are adequate enough for them to transfer data into the the country without restrictions.

“In an ideal world, during that 21-month period the U.K. can obtain from the EU [lawmaking] bodies a so-called adequacy decision, which will give the permission for the U.K. to receive, without any form of restriction, EU-originated personal data,” Voisin said. However, he also added, in the withdrawal agreement there is “absolutely no guarantee after this evaluation that the U.K. will receive such an adequacy.”

Establishing an adequate protection measure, which confirms a country's data protections conform to EU standards, isn't uncharted territory. Recently, Japan's data protection was deemed adequate by the EU, and the country joined Israel, Switzerland and Argentina in receiving EU approval for data transfers. 

If the EU does find the U.K.'s data protections are adequate, the policies for transferring EU-based data in the U.K. will be more straightforward, said Kingsley Napley senior associate Rowena Rix.

“It will largely operate as it does now,” noted Rix. Still, a timeline for obtaining that adequacy decision seems difficult as the U.K. government juggles other pressing issues, including entering international trade agreements to ensure imports and exports of food.

“There will be so much to consider in terms of Brexit. It's just a question of where they see that on their list of priorities. Who knows what that list will look like?” Rix said. “Organizations have to be prepared for the possibility of not having this finding of adequacy for a while.”

All this uncertainty means that those looking to transfer data between the EU and U.K. will have to wait an indeterminate amount of time for clarity.

“I think definitely in our community there's a wait-and-see approach, because you could be rewriting all your contracts and you don't have to,” Rix said. 

To be sure, some industries have taken a more proactive approach. “I think it's fair to say, across industry, we see a vast amount of companies doing nothing. However, there are certain industries, in contrast, that do take action,” Bird & Bird's Voisin said. “Especially because they feel better about the effect Brexit could have, or their compliance nature would force them.” He cited financial institutions and companies in the aviation industry as the industries more likely to prepare for Brexit. 

Such contingency plans can include adopting standard contractual clauses, which are approved by the EU as a legal basis to safeguard some transfers of personal data to third countries, including the U.K.

Still, Rix noted although the U.K. is leaving the EU, data privacy is here to stay in Britain and Northern Ireland.

“If anyone is under the illusion of 'we can be more relaxed over data protection,' I think that would be an incorrect conclusion,” she said.