Prior to the developments of the past few weeks, one might have expected the following sequence of events:
- Brexit takes place in some form other than EEA membership (unfortunately):
- The Commission grants an Adequacy Decision permitting EU27 personal data to be shared with parties in the EU).
- An appeal similar to the Schrems case is filed and works its way up to the ECJ.
- The ECJ rules as they did in Schrems, thus invalidating the Adequacy Decision, but probably allowing the UK and the EU27 time to put other arrangements in place.
- There would then be the risk that data transfers would be blocked until and unless an agreement analogous to Privacy Shield were negotiated between the UK and the EU27. The agreement would ideally be better structured than Privacy Shield, which has not yet been shown to be effective.
In light of the September 13th finding of the ECHR, one has to wonder whether it will still be possible for the Commission to issue the Adequacy Decision that appears in the second bullet. Recall that the ECHR found the UK guilty of abuse of human rights in September due to its overbearing surveillance. Under these circumstances, the Commission may not be able to grant the Adequacy Decision; having granted it, there is no assurance that it would be sustained.