GDPR implications for the UK post-Brexit

The EU GDPR may still apply if parties are to provide goods and services to individuals across the EU. So it really comes down to how your business will operate moving forward.

The data protection provisions set out in the Withdrawal Agreement between the EU and UK explain that any data transfers up to and including 31st December 2020 requires the EU GDPR to be applied, whereas anything thereafter will require the application of the UK GDPR. It is therefore imperative for organisations to be able to identify when data was collated and where the relevant party was residing at the time the data was collected. This will ensure the data has been processed following the applicable legislation.

 

As part of the trade deal agreed between the UK and EU, the transfer of data restrictions has been delayed for up to 6 months. This allows countries to become familiar with the changes due to come into place and offers time to adjust their requirements. i.e. requiring an EU/UK representative if there is no relevant appointed party in the specific country. It also allows data to continue to be transferred freely in the interim. 

Ways to determine if you require an overseas representative (UK or EU):

If the above applies, then you will need to ensure you are complying with the UK GDPR and the UK GDPR will require you appoint a representative in the UK.

The representative can be an individual, an organisation or a private company in the UK. The representative must be able to manage and represent your obligations under UK GDPR. Please note, that you should provide authorization (in writing) for your representative to act on your behalf to deal with any compliance matters, including communicating with data subjects and the regulatory body (ICO for the UK).

The ICO will continue to be the independent supervisory body for the UK’s data protection legislation. The UK government also intends to continue maintaining a close relationship with other countries’ supervisory bodies.

It is advisable for all UK companies to amend their GDPR documentation to ensure the reference is to UK GDPR moving forward.

Part 3 of the DPA 2018 still applies to relevant authorities processing for law enforcement purposes. Despite these particular rules originating from an EU directive, they are now set out in UK law and will continue to apply after the end of the transition period (with some expected minor tweaks to consider UK falling outside the EU).

It is certainly worth considering your policies and procedures to determine any amendments. If you require any assistance or guidance regarding this, please let us know. We can ensure this be done as seamlessly as possible to prevent any business disruption.

The ICO confirms the following:

The EU is replacing the current e-privacy law with a new e-privacy Regulation (ePR). The new ePR is not yet agreed.

If you are a UK-based digital service provider offering services in the EU, you may need to appoint a representative in one of the EU member states in which you offer services. You need to comply with the local NIS rules in that member state. If you also offer services in the UK, you also need to continue to comply with the UK rules regarding your UK services. 

The ICO have said however, if you offer trust services in the EU, you may also still need to comply with EU eIDAS law in EU member states. The UK no longer regulates that aspect of your services. We continue to work closely with EU supervisory authorities.

Below is a fact sheet of the key differences between the UK GDPR and the EU GDPR: