<!-- wp:paragraph -->
<p>After the UK leaves EU, it will become a country of 'non adequate Data Protection'. That means the end of the free flow of data. Just like any country outside the EEA, UK organisations exchanging data with the EEA will have to prepare Binding Corporate Rules or Standard Contracual clauses until a Privacy Schield type of agreement or an adequacy decision is adopted.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Meanwhile, The ICO, following the European Data Protection Board <a href="https://ico.org.uk/for-organisations/data-protection-and-brexit/data-protection-if-there-s-no-brexit-deal/the-gdpr/european-representatives/">guidance</a>, has suggested every UK organisation that has not an establishment in EEA to designate a representative.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You have an exemption if :</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> - you are a public authority; </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>or </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>- your processing is only occasional, of low risk to the data protection rights of individuals, and does not involve special category or criminal offence data on a large scale. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The <a href="https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp218_en.pdf">Working Party Article 29</a> has produced guidance on the risk – based approach in the EU data protection legal framework</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The European Data Protection Board's Draft Guidelines on Territorial Scope go further on the requirement for an EU/EEA representative set in Article 27.  </p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":164} -->
<figure class="wp-block-image"><img src="/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.06.png" alt="" class="wp-image-164" /></figure>
<!-- /wp:image -->

<!-- wp:image {"id":165} -->
<figure class="wp-block-image"><img src="/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.16.png" alt="" class="wp-image-165" /></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Which Supervisory Authority is competent ?</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In the recent case of the CNIL v Google, Google argued that the French CNIL was not the competent Supervisory Authority but the Irish Data Protection Authority. The CNIL argued Google LLC (and not Google France) was the data controller. Google Ireland Limited could not be considered Google LLC’s main establishment in the EU.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>It did not have any real and effective decision power over the relevant processing activities </li><li>the Irish entity does not determine the purposes and the means of the processing; </li><li>Google’s privacy policy does not make any reference to Google Ireland Limited as being the company making the decisions in this respect; </li><li>the Irish entity had not appointed a DPO to oversee such processing; and the Android operating system is solely developed by Google LLC.; </li><li>On top of that, Google mentioned in a letter that the transfer of responsibility in this respect from Google LLC to Google Ireland Limited would be completed on 31 January 2019. </li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Prohibition of forum shopping. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Therefore, in the absence of a main establishment in the EU, Google LLC could not benefit from the “one-stop-shop” mechanism, as it was not possible to clearly identify the lead supervisory authority. The CNIL thus confirmed that it was competent pursuant to Article 55 (which sets forth the competence of each SA for the processing carried out on its territory) and Article 58 (which lists the SA investigative powers) of GDPR to process the collective actions filed.</p>
<!-- /wp:paragraph -->