The UK government has confirmed that it will implement the EU General Data Protection Regulation, notwithstanding the UK's decision to leave the EU. This announcement confirms that UK businesses will need to become GDPR compliant by 25 May 2018.
On 24 October 2016, the Secretary of State for Culture, Media and Sport, Karen Bradley, gave oral evidence to a Select Committee affirming that the UK will implement the General Data Protection Regulation (the "GDPR"). The Secretary of State stated that the UK will still be an EU Member State in May 2018, when enforcement of the GDPR begins, and "therefore it would be expected and quite normal for [the UK government] to opt into the GDPR and then look later at how best … to help British business with data protection while maintaining high levels of protection for members of the public." Although the announcement sounds as though the UK is choosing to be subject to the GDPR, the legal reality is that the GDPR will automatically become binding in the UK on 25 May 2018.
The GDPR is the first major legislative change to European Data Protection law since Directive (95/46/EC), which was written in the mid-1990s. The GDPR affects almost all organisations doing business in the EU (even those located outside the EU), creates tighter limits on processing of personal data, and gives greater rights to individuals. Failure to comply with the GDPR risks a maximum penalty of the greater of €20 million or 4% of worldwide turnover. White & Case has published a detailed GDPR Handbook, offering guidance on all of these issues, available here.
What does the announcement mean for businesses?
There had been some uncertainty among UK businesses as to whether to invest resources in achieving GDPR compliance, given the lack of clarity around precisely what Brexit will look like. However, following the announcement by the Secretary of State, it is now explicitly clear that the GDPR will have the force of law in the UK, from 25 May 2018 until at least the date on which Brexit takes effect. This means that UK businesses, like businesses in any other EU Member State, will need to be compliant with the GDPR by 25 May 2018, or face enforcement action.
What happens after Brexit takes effect?
The direct consequences of Brexit for UK businesses depend largely on how the UK's relationship with the EU and the European Economic Area ("EEA") will look post-Brexit:
If the UK joins the EEA, then the GDPR will continue to apply in the UK. There will be some minor practical changes (e.g., businesses will not be able to select the UK as their place of "main establishment" for data protection purposes, and the UK Information Commissioner's Office (the "ICO") will have diminished influence in the EU). However, on the whole, the same data protection compliance requirements will continue to apply in the UK post-Brexit under this scenario.
If the UK does not join the EEA, then the GDPR will no longer apply in the UK. It will no longer be lawful to transfer personal data from the remaining EU Member States to the UK without additional legal protections (e.g., consent, or contractual safeguards). The UK will almost certainly seek an "adequacy decision" from the European Commission (removing the need for these additional protections). In order to obtain such a decision, the UK will need a national data protection law that provides essentially the same level of protection as is provided by the GDPR. However, even if the UK does obtain an adequacy decision, it will not necessarily have that decision in place on the effective date of Brexit, meaning that businesses may have to implement additional data transfer safeguards as an interim measure.
The ICO has stated that it will work with the government and provide advice on the continuing application of the GDPR, or any replacement regime, after Brexit. For UK businesses, the key conclusion is that GDPR compliance needs to be achieved by 25 May 2018. Post-Brexit, the UK will either be subject to the GDPR, or is likely to have a law that is functionally very similar to the GDPR. Consequently, efforts made to achieve GDPR compliance are likely to be sensible investments that will stand businesses in good stead over the long term.
Victoria Speers, a Trainee Solicitor at White & Case, assisted in the development of this publication.