Data transfers between the EU and UK post Brexit?

Changes to the UK constitutional and institutional settlement on Brexit day may affect the likelihood of the UK securing an adequacy decision under GDPR. Despite the UK Government claiming that on Brexit day, ‘it will have fully implemented EU [data] privacy rules’ it will have no equivalent of Article 8 of the EU Charter in domestic law. This may undermine efforts to achieve an adequacy ruling due to the decision of the CJEU in Maximillian Schrems v Data Protection Commissioner. The UK’s decision to continue with a data retention regime in Part 4 of the Investigatory Powers Act 2016 could also be at odds with the Article 8, Charter right. Conflict between the domestic legal settlement of the Investigatory Powers Act 2016 and the decision of the CJEU in Tele2 Sverige AB v Post-och telestyrelsen may also imperil an adequacy decision.