Google’s plan to move its British users’ accounts under US jurisdiction post-Brexit will make it more difficult for those in the UK to file a class-action lawsuit in the event of a data dispute, according to a leading data protection lawyer.
The legal shift, first reported by Reuters, would see tens of millions of Brits lose the robust data protections granted under the European Union’s General Data Protection Regulation (GDPR).
Go deeper with GlobalData
According to Reuters’ sources familiar with the plans, Google intends to require its UK users to acknowledge the shift from EU jurisdiction in a new terms of service agreement at the end of March.
This change in contract between Google and its UK users would mean any disputes would have to be tried in a US court under US data laws, said Sandip Patel QC, managing partner at law firm Aliant Law.
Class action lawsuits, such as the one brought by four million iPhone users against Google for allegedly using tracking cookies to bypass Apple privacy settings, would “almost become legally impossible” said Patel.
“If you have a dispute or grievance against Google, you will have to take it up in America. And whether the American courts will apply GDPR will be an argument to be had,” he added.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“It could be argued in those disputes ‘well, this dispute should be resolved by applying GDPR’. The reality is, the American courts will apply American law [because] this an American contract, it’s got an American jurisdiction clause.”
However, Robert Wassall, director of legal services at Norm Cyber, disagrees:
“This all seems to rest on jurisdictional issues. Google is and always has been a US based company. That has not stopped claims being brought against it in Europe. The crucial point isn’t about where the data is, but where the law applies. The GDPR applies outside the EU and (I anticipate) so will the UK-GDPR.”
US privacy laws notoriously provide weaker data protection than those in the EU. Any breach of UK users’ personal data can currently be tried in a European court under the GDPR, which threatens fines of up to 4% of an offending company’s annual turnover.
The UK government has previously stated that it intends to adopt much of the GDPR into UK law post-Brexit. During the Brexit transition period, the GDPR still applies to the UK.
“Therefore, the only thing that may change, immediately after the transition period ends on 31 December, is that it may be more difficult for organisations in EU countries to send personal data to the UK,” said Wassall.
A Google spokesperson told Verdict:
“Like many companies, we have to prepare for Brexit. Nothing about our services or our approach to privacy will change, including how we collect or process data, and how we respond to law enforcement demands for users’ information. The protections of the UK GDPR will still apply to these users.”
More tech firms could follow Google’s lead
Patel, who has been lead prosecutor in a number of high-profile hacking cases, said the move by Google was “not unexpected”.
“And in fact, it is, I think, widely anticipated in the wake of Brexit, that Google will seek to detach itself from GDPR,” he said.
“They just didn’t want to be sued anywhere other than their own courts in the United States of America.”
Google’s alleged move from EU data laws could also see other US tech companies follow suit.
“Whether it will mark a stampede, it’s unclear,” said Patel. “But I do think it’s the beginning of a trend, because where Google goes, everyone else will follow because of its sheer size and nature.”
This could have a knock-on effect for third parties doing business with Google, Patel added, “because Google has the power to control the market effectively in relation to IT”.
“And if you’ve got an independent contractor saying ‘well I’m still subject to GDPR’ they’ll say ‘sorry, I’m just going to go to an American company.”
Moving jurisdiction to the US could also make it easier for British law enforcement to access data of British Google users, with Reuters noting the recent Cloud Act in the US could make it easier still.
“The [Reuters story] suggests that the reason for this alleged move is because it will be easier for British authorities to recover data in criminal investigations,” said Wassall.
“This implies Google intend to do this to help the UK government, which I find difficult to believe.”
Read more: Amnesty condemns “insidious” Facebook and Google surveillance
