GDPR in Great Britain After Brexit

It happened. Since February 1^st, 2020, Great Britain finally stopped to be the member of the European Union. Does anything change with respect to personal data of EU citizen processed in the United Kingdom or personal data of British citizens processed in the European Union? In today’s post I’m trying to answer this question.

Transition Period

Great Britain left the EU on the basis of the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community (2019/C 66 I/01). That agreement introduced a transition period which will last until the end of 2020. Article 127 sec. 1 of the agreement stipulates: “Unless otherwise provided in this Agreement, Union law shall be applicable to and in the United Kingdom during the transition period”. It means that until December 31^st, 2020, nothing will change in the scope of personal data processing in the United Kingdom. The General Data Protection Regulation (GDPR) is still in force also within the territory of Great Britain and personal data transfer from the EU to Great Britain is allowed (according to the rules determined in GDPR).

What After Transition Period?

The transition period will last only until 31^st December, 2020. And what next? So far it is not clear. Everything depends on subsequent negotiations and arrangements between the EU and Great Britain. Some hints are included in Article 71 of the agreement on the withdrawal of the United Kingdom from the European Union, according to which:

1. Union law on the protection of personal data shall apply in the United Kingdom in respect of the processing of personal data of data subjects outside the United Kingdom, provided that the personal data:
   1. were processed under Union law in the United Kingdom before the end of the transition period; or
   2. are processed in the United Kingdom after the end of the transition period on the basis of this Agreement.
2. Paragraph 1 shall not apply to the extent the processing of the personal data referred to therein is subject to an adequate level of protection as established in applicable decisions under Article 45(3) of Regulation (EU) 2016/679 or Article 36(3) of Directive (EU) 2016/680.
3. To the extent that a decision referred to in paragraph 2 has ceased to be applicable, the United Kingdom shall ensure a level of protection of personal data essentially equivalent to that under Union law on the protection of personal data in respect of the processing of personal data of data subjects referred to in paragraph 1.

What is it going to look like in practice? I don’t know. However, in the worst case sec. 3 stipulates, that the United Kingdom will ensure a level of protection of personal data essentially equivalent to that in the EU law. Perhaps data transfer to Great Britain will not be so problematic.