A date with data destiny
The updated General Data Protection Regulation (GDPR) – one of those irritating bits of bureaucracy that Brexiteers complain about – is scheduled to come into force in May next year, writes Edward Fennell.
“The UK was one of the dissenting voices in negotiations about the regulations,” says Pulina Whitaker, a partner at the City of London office of US law firm Morgan Lewis. She reminds us that British officials were “particularly vocal about the onerous impact on UK businesses” that the measures were viewed as imposing.
Nonetheless the regulation will be firmly in place by the time the UK bids farewell to the EU possibly in the spring/summer of 2019.
That single market again
So once the UK has brushed the European dust from its shoes, will this regulation be cast into the celebratory bonfire of the regulations? Probably not. Despite quitting the EU, says Whitaker, “it seems unlikely that the UK will reduce the extent of data protection obligations on UK businesses”.
Why? The UK’s data protection authority, the Information Commissioner’s Office, has already advised that UK data protection standards will need to be equivalent to those in the EU regulations if the country wishes to trade with the European single market after leaving the bloc.
“The UK is unlikely to want to be seen as being out of step with the rest of Europe which will … remain a significant trading partner,” surmises Whitaker.
“UK organisations with European offices or which offer goods or services to European consumers will continue to be subject to the [the regulations] post-Brexit as regards those European operations. [Hence] the government will need to enact domestic data privacy legislation to replace the GDPR when the UK exits the EU.”
Data transfer
A failure to retain EU standards would be likely to reduce the current level of data privacy protections afforded to individuals. It could be argued that it is in everyone's interests to keep them as most UK businesses are likely to need to transfer personal data to Europe and also to other countries outside the EU such as the US.
While the UK remains part of the EU, there are restrictions against transferring personal data without consent from the individual, other than to certain “adequate” countries such as Canada or Switzerland, or unless the business has in place a legally permissible mechanism, such as model clauses or binding corporate rules.
British ministers will need to decide if the UK is to retain the same restrictions for cross-border transfers or adopt an alternative. In particular, after Brexit, we know that the EU-US privacy shield will no longer apply to the UK and neither will protections for EU citizens under the umbrella agreement or the Judicial Redress Act to enforce privacy breaches in the US courts.
Feeling inadequate
The UK will need to decide on whether it will adopt a similar model to the privacy shield for data transfers from the UK to the US. The UK is also likely to apply to the European Commission for a decision of “adequacy”, which will allow EU countries to transfer personal data to the UK without restrictions.
“Obtaining an adequacy decision,” says Whitaker, “depends on whether the government has passed laws which are materially similar to the GDPR.”
Another change implemented by the GDPR is an obligation to notify a data protection authority within 72 hours of becoming aware of a breach – and in certain circumstances the individuals affected by the breach.
“The government will need to decide if it will pass a data breach notification law, either similar to the strict GDPR requirement or one adapted to our approach of pro-business legal requirements,” says Whitaker.