After years of discussion and debate, the UK will finally be leaving the EU single market and customs union at the end of the year. The UK and EU are now in a transitionary period that will last until 31 December 2020, at which point all current agreements will cease to apply.
As the final deadline inches closer, the headlines have been dominated by serious issues such as the creation of a border in Ireland, managing the transport of goods, and facilitating travel to and from the UK. The end of the transition period will also have a major impact on how data is transferred and handled, but with so many physical challenges to address, the virtual side of things has gone largely unnoticed.
Go deeper with GlobalData
The GDPR has its own timeline, and the UK will continue under its remit until 31 January. The European Commission has been conducting a data adequacy decision to determine if the UK will still be a trusted location for the private data of EU citizens in 2021. The outcome will have a major impact on the ability of businesses to trade with the EU, and even to operate with partners and regional branches. Alongside this, there are several other complications in play.
The biggest data adequacy challenges
Membership of the EU has had a significant influence on the UK’s data privacy laws for decades, going all the way back to the EU Data Privacy Act in 1984. Most recently the UK was included under the strict remit of the EU GDPR, despite the fact the Brexit vote had passed by the time the regulation came into law in May 2018. While the UK Government has announced plans to maintain the standards of the GDPR moving forwards, we will not automatically retain GDPR equivalency after the transition period ends in December.
In effect, the UK will become a ‘third country’, meaning that data cannot be transferred here without special contractual agreements between organisations and their partners. With this being largely uncharted territory, the validity of these agreements is also certain to face legal disputes. Managing the flow of data to and from the UK and EU will become more resource-heavy and expensive as a result.
Another spanner has been thrown into the works by the most recent developments in the legal action by Australian privacy activist Max Schrems against Facebook in Ireland. The case, Schrems II, forbids the social media giant from transferring the data of any EU citizens to the US for processing, with a threat of fines of up to 4% of annual turnover if the conditions are not met.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThe ruling was based on the conclusion that the US’ surveillance practices, as revealed by whistle-blower Edward Snowden in 2013, meant it cannot be trusted with the data of EU citizens. The main issue is the US Government’s power to seize the personal data of private citizens without giving affected individuals any notification or recourse.
The UK was named as a partner in many of the global surveillance programmes revealed by Snowden. Alongside the UK’s own surveillance laws, such as the Regulatory Investigatory Powers Act 2000 (RIPA), this means the UK may no longer be seen as providing adequate safeguarding for the data of EU citizens. While the Schrems II ruling so far only applies to Facebook, it may well have much wider implications for any UK business that deals in data from the EU.
With the final deadline less than two months away, UK businesses with partners in the EU and elsewhere in the world will need to act quickly to prepare for the challenges and uncertainty coming up.
So what are the main priorities ahead of 31 December?
1) Understanding data flows
The first priority for all businesses should be to ensure they have a full understanding of what personal data they are sending to who, and to which countries. In theory, all companies should already have this knowledge as part of their GDPR compliance efforts, but it would be wise to double-check and make sure everything is up to date.
This data inventory should also include the companies that host corporate data, particularly services such as Office 365, that are being used to handle data storage and email processing.
2) Understanding client and vendor agreements
Firms should also be checking through their client and vendor agreements to ensure they can be amended ahead of time. While many aspects of the road ahead for data privacy are still unknown, it will be beneficial to know that contracts can be amended as the situation develops. Unless there has been a reason to pay particular attention to this area in the past, it is likely that at least some contracts will need work to be updated.
3) Ensuring the protection of unstructured data
Among the many limitations we are likely to see coming into play, EU-based companies are likely to lose the ability to freely send documents to UK partners for processing. Previously this has been carried out with the use of encryption to ensure personal data is protected, but in the future, it may require information to be redacted or removed from any documents. Manually redacting documents is time-intensive work that can drastically slow down operations, as well as consuming a lot of manhours better spent elsewhere. Implementing automated redaction processes will help to minimize the workload and limit disruption.
Preparing for uncertainty
Like many aspects of Brexit, the details of how data privacy will be impacted are still unknown even at this late stage. Whatever the outcome, acting now to solidify data transfer processes and protection capabilities will help businesses to be more confident in tackling whatever the post-EU landscape has to offer.
Regardless of whether the UK as a whole is judged to be adequate, these three steps will serve as a solid foundation for building new data processes as the details emerge in 2021.
Darren Wray is the co-founder of Guardum, a data privacy company providing compliance tools for businesses.
Read more: Post-Brexit EU data adequacy in jeopardy over UK privacy concerns
