On Thursday 21th July took place at the Mediapro’s Museum a new CloudBreakfast session, thematic breakfasts in which a specialist speaks about trending topics connected to our sector. In this case, we talked about Brexit and how could it affect to data protection, especially for companies who have their clouds located in the United Kingdom.
Xavier Ribas, from Ribas y Asociados, was in charge of the session. He is a lawyer specialized in digital right since 1987, in data protection compliance since 1992 and in penal compliance since 2010.
According to Ribas the Brexit has been a black swan for some companies, this means that nobody expected it to happen and many companies had not created a plan B in order to be ready for it.
Companies must be ready for whatever can happen, for that reason it is necessary for them to have a decision-making protocol. This protocol’s aim is to avoid that the lack of a suitable risk analysis plus the lack of a B plan could generate an unexpected impact in the company. For example, it is foreseen that whenever the United Kingdom leaves the European Union, the data protection level will fall considering that they will try to imitate the current model in USA.
The action protocol for the Brexit must follow these steps:
1. Elaboration of a map that includes relationship between companies and institutions in the United Kingdom
2. Opportunity and risk analysis, paying attention to the most affected areas: tourist industry and real estate sector.
3. Risk map update
4. Impact studies for signed contracts with English companies
5. Trade flow and supply source’s identification
6. Alternative supply sources’ research
7. Actions to do negotiation with English suppliers and customers
8. Strategy to follow during a temporary period (2 years) negotiation
9. Impact evaluation in companies with cash pooling
10. Assessment of consequences of the regulations’ uniformity disappearance in the EU
11. Norwegian model’s analysis in order to make a forecast in regulatory matters
12. Impact on data transfer valuation and redefinition of the strategy
13. Impact on company’s employees valuation
14. Impact on product and service sales valuation
15. Economic impact due to duties or similar
16. Analysis of risks associated to GBP’s fluctuation
17. Redefinition of the scope of control related to Spanish subsidiaries in the United Kingdom
18. Business continuity plan’s update
Xavier Ribas explained down the last detail each of those steps and he remarked how important is to know not only where your data are, but also where your suppliers’ data are. As a company, even if you commit to locate your data in Europe, you cannot ensure that your suppliers do the same thing.
Even though we have to wait for a formal communication of UK’s exit from Europe, companies should start to create an alternative plan with a relationship map with the United Kingdom and to evaluate actions to do in different possible situations, by identifying opportunities and business threats, including a continuity prediction of contracts and data treatment.
If you are interested in CloudBreakfast’s thopics and you would like to attend another session about Brexit do not doubt, send us an email to email@example.com and we will inform you.