Brexit & GDPR: Here Is What You Need To Know

The General Data Protection Regulation (GDPR) and Brexit have been two of the most significant legal and political developments in Europe over recent years. The GDPR, which came into effect in May 2018, is a comprehensive piece of legislation designed to give individuals control over their personal data and impose strict obligations on businesses that process this data. On the other hand, Brexit marked the United Kingdom’s exit from the European Union, which officially occurred on 31 January 2020, following years of political debate and negotiations.

The intersection of these two monumental changes raises important questions for businesses and individuals alike. In the aftermath of Brexit, the UK’s legal framework around data protection has evolved, but not without considerable complexity and uncertainty. For companies operating across borders, particularly those dealing with personal data flows between the UK and the EU, understanding the ongoing relationship between Brexit and the GDPR is essential.

This article explores the key aspects of Brexit’s impact on GDPR compliance, the UK’s own data protection laws, and how businesses can navigate the challenges that arise from these regulatory shifts.

A Brief Overview of the GDPR

The GDPR is a regulation by the European Union designed to strengthen and unify data protection laws for individuals within the EU. It applies to all companies, regardless of their location, as long as they process the personal data of EU residents. Key principles of the GDPR include transparency, accountability, and data minimisation, and it establishes strict requirements around how businesses handle and protect personal information.

The regulation covers a wide array of rights for individuals, including the right to access their data, the right to have their data erased (the “right to be forgotten”), and the right to object to certain types of data processing. For businesses, the GDPR introduces heavy penalties for non-compliance, with fines potentially reaching up to €20 million or 4% of annual global turnover, whichever is higher.

Before Brexit, the UK was subject to the GDPR as part of its membership in the EU. As such, British companies, like their European counterparts, were required to comply with its stringent provisions. But with Brexit, the UK’s legal relationship with the GDPR has changed significantly.

Brexit and Data Protection: The Transition Period

After the UK formally left the EU in January 2020, it entered a transition period that lasted until 31 December 2020. During this time, EU law, including the GDPR, continued to apply in the UK. The transition period provided businesses with a degree of continuity, allowing them time to adjust to the legal and regulatory changes that would follow once the UK was no longer bound by EU laws.

During the transition period, UK companies that operated in the EU were still required to comply with the GDPR, and businesses within the EU that handled the personal data of UK citizens were likewise obligated to adhere to GDPR standards. This ensured that data flows between the UK and the EU remained uninterrupted during this temporary phase.

However, once the transition period ended, the legal framework governing data protection in the UK diverged from that of the EU, creating a new set of challenges for businesses operating across borders.

Post-Brexit: The UK GDPR

After the transition period ended, the UK ceased to be part of the EU’s legal regime, including the GDPR. To address the need for a domestic data protection framework, the UK government implemented its own version of the GDPR, commonly referred to as the “UK GDPR.” This was essentially a copy of the EU GDPR, retained in UK law under the European Union (Withdrawal) Act 2018, with necessary amendments to reflect the UK’s status as a non-EU country.

The UK GDPR works in conjunction with the Data Protection Act 2018 (DPA 2018), which was the primary legislation for data protection in the UK even before Brexit. Together, the UK GDPR and the DPA 2018 provide the core legal framework for data protection in the UK post-Brexit.

Key Differences Between the EU GDPR and the UK GDPR

While the UK GDPR is largely identical to the EU GDPR, there are several notable differences. Understanding these distinctions is crucial for businesses that operate both within the UK and the EU.

1. Jurisdiction and Scope: The EU GDPR applies to businesses operating within the EU and those outside the EU that offer goods or services to, or monitor the behaviour of, individuals in the EU. Similarly, the UK GDPR applies to organisations based in the UK and those outside the UK that process the personal data of individuals in the UK. Thus, companies that operate in both jurisdictions must now comply with both the UK GDPR and the EU GDPR, depending on where the data subjects are located.
2. Data Protection Authorities: Under the EU GDPR, the European Data Protection Board (EDPB) plays a central role in ensuring the consistent application of data protection laws across the EU. With Brexit, the UK is no longer part of the EDPB. Instead, the UK’s Information Commissioner’s Office (ICO) is the primary regulator for data protection in the UK. This shift means that businesses operating in both the UK and the EU may need to deal with both the ICO and EU regulators, which can add complexity to compliance efforts.
3. International Data Transfers: One of the most significant challenges arising from Brexit is the issue of international data transfers. Under the EU GDPR, personal data can be transferred freely within the European Economic Area (EEA). However, transferring data to countries outside the EEA, known as “third countries,” is subject to strict conditions unless the European Commission has deemed that the country offers an adequate level of data protection (an “adequacy decision”).After Brexit, the UK became a third country in relation to the EU, meaning that the free flow of personal data from the EU to the UK was no longer guaranteed. In June 2021, the European Commission granted the UK an adequacy decision, recognising that the UK’s data protection laws provided a level of protection equivalent to that of the EU GDPR. This decision allows personal data to flow freely from the EU to the UK without the need for additional safeguards, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs).However, the adequacy decision is subject to a four-year review period, and there is no guarantee that it will be renewed after that time. If the adequacy decision is not renewed, businesses would face significant challenges in transferring data between the EU and the UK, requiring them to implement alternative safeguards to ensure compliance.
4. Representation in the EU: Companies that are based outside the EU but process the personal data of EU residents must appoint a representative in the EU under the EU GDPR. This requirement also applies to UK companies following Brexit. Similarly, businesses based outside the UK but processing the personal data of UK residents must appoint a UK representative under the UK GDPR. This dual requirement adds an additional layer of administrative complexity for companies that operate in both jurisdictions.

The Adequacy Decision: Current Status and Future Uncertainty

As mentioned earlier, the EU granted the UK an adequacy decision in June 2021, allowing personal data to flow freely between the two regions. While this decision provided much-needed relief for businesses, it also comes with certain caveats and uncertainties.

The adequacy decision is not permanent. It is subject to review every four years, and the European Commission has the power to revoke it if it finds that the UK’s data protection regime no longer provides an adequate level of protection. This could occur, for example, if the UK makes significant changes to its data protection laws, which might diverge from EU standards over time.

Furthermore, the adequacy decision has been subject to legal challenges from privacy advocates who argue that the UK’s surveillance laws, particularly those under the Investigatory Powers Act 2016 (often referred to as the “Snooper’s Charter”), are not compatible with EU data protection standards. These challenges, if successful, could lead to the revocation of the adequacy decision, causing significant disruption to data flows between the UK and the EU.

In the event that the adequacy decision is revoked, businesses would need to implement alternative mechanisms to ensure the lawful transfer of personal data between the UK and the EU. This could include the use of SCCs, BCRs, or other safeguards approved under the GDPR. However, these mechanisms can be complex and resource-intensive to implement, especially for smaller businesses.

The Impact on Businesses: Compliance Challenges

For businesses that operate both in the UK and the EU, the post-Brexit landscape presents several challenges in terms of GDPR compliance. These challenges can be broadly grouped into two categories: legal and administrative burdens.

1. Dual Compliance: Companies that process the personal data of individuals in both the UK and the EU are now subject to two separate regulatory regimes: the UK GDPR and the EU GDPR. While these regimes are largely similar, the differences in jurisdiction, representation requirements, and regulatory oversight mean that businesses must be prepared to navigate both sets of rules. This dual compliance can be particularly challenging for small and medium-sized enterprises (SMEs) that may lack the resources to manage multiple compliance frameworks.
2. Data Transfers and Contracts: The issue of data transfers between the UK and the EU is a significant concern for many businesses, especially those that rely on cross-border data flows as part of their operations. While the adequacy decision currently allows for the free flow of data between the two regions, the uncertainty surrounding its future creates a level of risk for businesses. Companies must be prepared to implement alternative safeguards, such as SCCs or BCRs, if the adequacy decision is not renewed.
3. Representation Requirements: The requirement to appoint a representative in the UK and the EU adds another layer of complexity for businesses. This is particularly relevant for companies based outside of both regions that process personal data from individuals within the UK and the EU. Appointing a representative involves additional costs and administrative burdens, and businesses must ensure that they comply with these obligations to avoid penalties.
4. Regulatory Oversight: Businesses that operate in both the UK and the EU may find themselves subject to oversight from both the ICO and EU data protection authorities. This can lead to potential conflicts in regulatory interpretation and enforcement, as well as increased scrutiny from multiple regulators. Companies must be prepared to engage with both authorities and ensure that their data protection practices meet the requirements of both jurisdictions.

Steps Businesses Can Take to Ensure Compliance

To navigate the complexities of Brexit and GDPR compliance, businesses should take a proactive approach to data protection. Here are some steps that companies can take to ensure they remain compliant with both the UK GDPR and the EU GDPR:

1. Review Data Flows: Businesses should conduct a thorough review of their data flows to determine where personal data is being transferred between the UK and the EU. This includes assessing whether data is being transferred to or from third countries and whether appropriate safeguards are in place.
2. Update Contracts and Policies: Companies should review and update their contracts and policies to ensure that they comply with both the UK GDPR and the EU GDPR. This includes incorporating appropriate data protection clauses in contracts with service providers and ensuring that privacy policies reflect the requirements of both jurisdictions.
3. Appoint Representatives: Businesses that are subject to the representation requirements under the UK GDPR and the EU GDPR should appoint representatives in the relevant jurisdictions. This ensures that they have a point of contact for data protection authorities and individuals within both regions.
4. Monitor Regulatory Developments: Given the ongoing uncertainty surrounding the adequacy decision and potential changes to the UK’s data protection regime, businesses should closely monitor regulatory developments in both the UK and the EU. This includes staying informed about changes to data protection laws and guidance from regulators.
5. Implement Data Transfer Mechanisms: In the event that the adequacy decision is not renewed, businesses should be prepared to implement alternative data transfer mechanisms, such as SCCs or BCRs. Companies should also ensure that they have the necessary documentation and processes in place to demonstrate compliance with these mechanisms.
6. Engage with Legal and Compliance Experts: Given the complexity of navigating dual compliance with the UK GDPR and the EU GDPR, businesses may benefit from engaging with legal and compliance experts who specialise in data protection. These experts can provide valuable guidance on how to manage the regulatory requirements of both jurisdictions and ensure that businesses remain compliant.

Conclusion

Brexit has introduced significant changes to the legal landscape for data protection in the UK, with important implications for businesses that operate across borders. While the UK GDPR closely mirrors the EU GDPR, the divergence in regulatory oversight, data transfer rules, and representation requirements creates new challenges for companies.

The EU’s adequacy decision, while providing temporary relief, is subject to review and potential revocation, adding to the uncertainty faced by businesses. Companies must be proactive in ensuring that they comply with both the UK GDPR and the EU GDPR, taking steps to address the legal and administrative complexities of post-Brexit data protection.

By staying informed, reviewing data flows, updating contracts, and implementing appropriate safeguards, businesses can navigate the evolving landscape of data protection and ensure they remain compliant with both UK and EU regulations.