Gibraltar releases position on EU data transfers in the context of Brexit

The government of Gibraltar has released a technical notice regarding the impact of Brexit on data transfers between Gibraltar and the EU. On 31 December 2020, the Brexit Transition Period under the EU-UK Withdrawal Agreement will come to an end. The end of the transition period will bring an end to the current status quo whereby Gibraltar, its citizens and its business, had enjoyed EU rights. The purpose of this notice is to explain what the effect of those changes are on rules which regulate the transfer of personal data between Gibraltar and the UK, and, separately, between Gibraltar and the EU. Like the UK has done for itself, Gibraltar has enacted legislation confirming that it considers the EU to have an adequate data protection regime. This would allow entities established in Gibraltar to transfer data with EU member states after December 2020. This will be the case even if there are no separate arrangements on the UK and Gibraltar’s future relationship with the EU. However, the same cannot be said with respect to the flow of data from the EU to Gibraltar. After 31 December 2020, any transfer of personal data from the EU to Gibraltar (other than what is referred to as ‘legacy data’ covered by Article 71 of the UK-EU Withdrawal Agreement) will not be treated as having been transferred within the EU. In the absence of the EU declaring Gibraltar’s data protection regime adequate, and unless the transfer of data falls within one of the derogations contained in Article 49 of the GDPR, the options for EU entities to be able to transfer personal data to Gibraltar after 31 December 2020 rely on the following ‘alternative transfer mechanisms’, such as standard contractual clauses (SCCs).