What will UK GDPR look like from January 2021?
From January next year, the UK’s Data Protection Act 2018 will become commonly referred to as UK GDPR. The new data protection regime in the UK will look similar to EU GDPR, but don’t be deceived businesses will need to examine in detail the changes about to take place.
These changes include:
- How UK-EU personal data transfers continue in relation to compliance with UK-EU data protection laws, particularly regarding adequacy arrangements.
- The storage of personal data post Brexit. In particular, where?
- Whether a business needs to appoint local representatives for UK and EU GDPR.
- How compliance documentation may be affected.
- How the UK GDPR and EU GDPR will diverge over time.
First and foremost, from 11pm on December 31, 2020 there will be an adequacy and legacy gap that will need to be addressed. This is referred to in Article 71 of the Brexit Withdrawal Agreement stating that EU data protection law will continue to apply in the UK for legacy non-UK personal data and withdrawal agreement data after the end of the Brexit Transition Period.
Nevertheless, if UK data protection law starts to diverge from the data protection rules that apply under Article 71, businesses will need to distinguish legacy non-UK personal data and withdrawal agreement data from other personal data.
Note: most data protection lawyers agree that over time UK GDPR will diverge from EU GDPR.
Here’s an example of the situation:
A business opens a new office in Paris with its HQ in London. As a result of the new Paris office, the London HQ will be tied to several different types of data protection rules and issues, including:
- Implications of the updated UK GPDR from 2021
- Legacy issues involving non-UK personal data and EU GDPR as it stands in Paris from 2021
- The status of adequacy arrangements between London and the EU and Paris (the French regulator CNIL is one of Europe’s most robust supervisory authorities)
- Increasing divergence between UK GDPR and EU GDPR. One example of this is the recent withdrawal of adequacy by the European Commission of the US Privacy Shield. Prime Minister Boris Johnson has already stated that the UK will draft its own data protection laws post Brexit. Could the UK grant adequacy to the US as part of a trade deal and what would this mean for UK/EU data protection laws regarding data transfer to and from the UK?
- Third countries that have adequacy arrangements with the EU (such as Israel, Canada and New Zealand) and are sharing data with the UK will have to make a decision about the UK adequacy status in the future. The UK has pledged to give adequacy arrangements to EEA members and other adequate jurisdictions recognised by the EU – although this has yet to be implemented.
- As with the US example, will the UK grant adequacy arrangements with other countries, which do not have adequacy arrangements with the EU? Australia is one example. What will this mean for a common data protection framework between the UK and EU.
Be prepared for no adequacy decision
As well as all these complexities, if there is no adequacy decision between the EU and UK before December 31, 2020, transferring data from the EEA to the UK will need to involve issuing standard contractual clauses (SCC) to maintain data flows. This has been made more complicated by the recent Schrems 2 judgement by the European Commission (the ruling that invalidated the US Privacy Shield agreement) resulting in what people are calling SCC+ .
This will mean that a business will have to:
- Seriously re-look at their data protection compliance
- Update their records of processing
- Update existing SCC obligations if personal data is transferred out of the UK (an SCC form is essentially a template that can’t be altered). This will need extra legal advice and monitoring
- Carry out a data protection impact assessment (even for a small business this is advisable) and risk assess different locations inside the business group and externally with existing third-party vendors and suppliers
- Review due diligence for vendors and suppliers, particularly in the US and other locations inside and outside the EEA.
Will you need a UK and EU representatives?
As for UK representatives:
The UK representative requirement is the same as the EU representative requirements for UK companies. It applies to any business outside the UK that must appoint a UK representative if it:
- Has no UK office
- Monitors UK individuals or targets goods and services in UK
- Transfers data to and from the UK.
Key responsibilities of the UK representative are:
- To maintain records of processing for controllers/processors
- To maintain communications between individuals and the controllers/processors and between the ICO
- To provide information to the ICO
- To ensure they are the point of contact for UK data subjects on privacy notices
What you need to do NOW!
- Look at what data protection laws apply to your business, i.e. UK GDPR and/or EU GDPR). Start mapping your data legacy data activities and work out if adequacy arrangements apply to your business. If there is none in place, start using SCCs and remember to use an SCC+.
- If adequacy decisions have not been made look at legacy personal data collected up to January 2021.
- Map your data flows, including your records of processing.
- Make sure you know which supervisory authorities are relevant to your business (local data protection laws can differ from GDPR).
- Appoint UK and/or EU representatives where relevant.
- Check whether the UK has recognised the adequacy of the EEA and relevant global locations.
- Make sure you update your privacy notice with reference to EU//UK personal data transfers and who your representatives are in the EU and UK.
- Talk to your legal advisors about SCC+, adequacy arrangements and we recommend carrying out a data protection impact assessment.
If you’d like to know more about our services, which include:
- virtual data protection officer
- penetration-testing
- remote worker productivity monitoring
- our unique cyber bodyguard
Call Mark on 01905 969215 or click here