Data expert warns of UK-EU information flow halt post-Brexit

A CYBER-security and data expert has said she’s concerned about the future for data flow from the UK following Brexit.

Maria Farrell said that in the event of a no-deal Brexit next March, the law provided for data flow between the UK and EU to come to an end.

And she added that the cessation of data flow could become a major headache for smaller businesses, as legal advice on preparing for the change could cost each around £10,000.

Ms Farrell is one of the speakers at Monday’s Dublin Info Sec, a major conference staged by Belfast Telegraph publisher INM.

She said the law on data transfer in the event of a no-deal Brexit was “completely unambiguous”.

“The data has to stop flowing from — let’s say Ireland to the UK or Ireland to Northern Ireland — as the UK will immediately stop being in the EU, and as yet doesn’t have a formal measure for transfer of personal data,” she said.

And added people were wrong to assume that safe and legal transfer of personal data would continue after Brexit because of the UK’s compliance with the General Data Protection Regulations, (GDPR), which came into force in May.

She said large companies with operations on both sides of the border will have already worked out on a contractual basis how data transfer would operate.

She added: “The European Commission has standard contractual clauses and presumably people will incorporate those, but the process needs to be property lawyered. That whole process can cost £10,000.”

She said jurisdictions can seek “adequate regime” status from the EC, but a process to qualify could take six months.

“The UK is a vastly more surveilling society than a lot of EU countries. There is a belief that we will obtain adequacy because we implemented GDPR but the reality is adequacy takes longer. You can only apply for adequate regime status after Brexit, and there could then be six months back and forth with the Commission,” she pointed out.

Ms Farrell has also written about the Internet of Things — the development of devices on the internet which can interact directly with humans — and its potential impact on privacy.

She has reservations about devices such as Amazon’s personal assistant device Alexa, which responds to spoken commands. “I can see why people enjoy those but I would not have one in my house for a bunch of reasons. There are privacy reasons but the whole point of the Alexa device is it’s listening to you all the time and it doesn’t just perk up when we say: ‘Alexa, we need some toilet rolls’.”

Maria Farrell is a tech policy consultant and writer. She is a speaker at Dublin Information Sec 2018, Ireland’s cyber-security conference which takes place on Monday at Dublin’s RDS. Dublin Information Sec is an INM event. For tickets and more information, go to https:// events.inm.ie/dublin-information-sec-2018