Uncertainty prevails in post referendum Britain. We have a new government, significant changes to government\u2019s digital leadership, and a mandate to leave the EU. \u00a0The launch of the UK government\u2019s Digital Strategy is long overdue, and there is little clarity on where digital will feature on May\u2019s \u201cto do\u201d list.<\/p>\n
Nonetheless, life goes on. Following the formal adoption of the General Data Protection Regulation (GDPR) in May 2016, the UK had been slowly coming to terms with the need to become compliant with the new law by May 2018.<\/p>\n
The GDPR is intended to harmonise the data protection law of the 28 Member States, and make the current regulation fit for the digital age.\u00a0 Although it is doubtful that anyone would disagree on the intent of the GDPR, the devil is in the detail, and it has not been universally welcomed.<\/p>\n
Does Brexit let the UK off the GDPR hook? We are getting mixed messages, with the Information Commissioner\u2019s Office (ICO) saying that the incoming law will not change, despite Brexit, whilst the Minister responsible for data protection, Baroness Neville-Rolfe, recently said that \u201cfor a period the future [for data protection regulation] would be uncertain\u201d until Brexit negotiations got underway, and the UK understood whether it was aiming to leave, or stay within the EEA.\u00a0\u00a0This is a key area where industry needs early clarity in terms of the government\u2019s intentions.<\/p>\n
What is certain is that the UK will continue to do business with the EU, and that EU citizen data will continue to be stored or processed within the UK. \u00a0The scope of the new law means that the GDPR applies to EU citizen data, irrespective of where that data is being processed.\u00a0\u00a0This means that the UK will either have to adopt the regulation, put in alternative regulation that is deemed \u201cadequate\u201d by the EU, or rely on EU model clauses or even a Privacy Shield type arrangement. \u00a0Either way, it is highly unlikely that the UK will have exited the EU by the time the GDPR takes effect in May 2018.<\/p>\n
This is why most companies are continuing with their GDPR plans, despite Brexit. \u00a0Some companies may stall plans until there is clarity – or not even start the planning in the first place.\u00a0\u00a0These companies are taking a big risk, given the extent of the changes. \u00a0One of the most significant changes will be the sanctions that can be enforced under GDPR. \u00a0These will be much tougher than now \u2013 up to \u20ac20,000,000, or 4% of global turnover, whichever is the higher. \u00a0The definition of personal and sensitive data under GDPR will become much wider, to include genetic and biometric information, as well as online identifiers. \u00a0Data subjects will have significantly increased rights, and the conditions for international data transfers will become more stringent.<\/p>\n
UK companies will need to ensure that their policies, processes, privacy notices and contracts are in compliance with the new regulation. \u00a0The UK cannot afford to lag behind the rest of Europe in terms of its data protection regulation, not least because the UK must continue to trade with Europe, but also because robust and modern data protection regulation will help to grow wider investment in the UK\u2019s digital economy. \u00a0Companies should act now to comply with the impending regulations, whether or not the trigger on Article 50 is pulled this year.<\/p>\n","protected":false},"excerpt":{"rendered":"
Uncertainty prevails in post referendum Britain. We have a new government, significant changes to government\u2019s digital leadership, and a mandate to leave the EU. \u00a0The launch of the UK government\u2019s Digital Strategy is long overdue, and there is little clarity on where digital will feature […]<\/p>\n","protected":false},"author":2,"featured_media":18191,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"class_list":["post-16669","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","region-north-west","topic-cyber-security","topic-ai","topic-cloud","topic-government","topic-data-analytics"],"acf":[],"yoast_head":"\n