60

Now that Brexit happened, does GDPR include UK customers, or not anymore?

Improve this question
8
  • 3
    What about EU citizens based in the UK? Wouldn't they still be subject to GDPR?
    – J. Doe.
    Feb 3, 2020 at 9:04
  • 12
    @J.Doe. GDPR is not about any citizens whatsoever. It's about people in the EU.
    – Greendrake
    Feb 3, 2020 at 9:38
  • 6
    @J.Doe. for example, EU citizens who are in (for example) Japan have the same status with respect to the GDPR as Japanese citizens in Japan.
    – phoog
    Feb 3, 2020 at 14:30
  • 1
    @BobsaysreinstateMonica if you (as the data controller/processor) are in EU, then GDPR applies to all your users no matter where they are (Article 3.1). If you're not in EU, then GDPR applies to those of your users who are in EU (Article 3.2, it has some more specific qualifications).
    – Peteris
    Feb 4, 2020 at 17:31
  • 1
    @BobsaysreinstateMonica the law uses the phrase "in the Union." It's not defined further. I suppose the court will provide clarity if it is necessary, but I doubt they've had chance to do so yet. I don't think that a temporary absence will affect a data subject's status with respect to being "in the Union"; a more interesting question will be the effect of moving permanently to a so-called third country, or the effect of temporary visits by third-country residents to the territory of a member state.
    – phoog
    Feb 4, 2020 at 18:33

4 Answers 4

Reset to default
58

GDPR will continue to apply to UK customers directly until the end of the transition period (31 December 2020):

So, while the UK will no longer have any voting rights, it will need to follow EU rules. The European Court of Justice will also continue to have the final say over any legal disputes.

Thereafter, the Data Protection Act 2018 will continue to apply (which itself applies "GDPR standards"). Six of one, half a dozen of the other.

Improve this answer
10
  • 20
    Didn’t the U.K. put GDPR into law as the DPA 2018? Which would mean it indirectly applies until that is overturned?
    – Tim
    Feb 3, 2020 at 9:09
  • 2
    @MSalters I don’t think that is expected right now. Closer to the transition end date we will know more, but right now I’ve not seen anything suggesting the DPA will revert to 1998...
    – Tim
    Feb 3, 2020 at 10:31
  • 10
    @MSalters If you read through the official bureau guidelines about leaving the EU, they expect all laws will stay the same by default, and will only be reconsider on a case by case basis. That doesn't mean there will be no "throw away everything tainted with EU" law, but it would just be yet another populistic decision, not part of some grand strategy.
    – Luaan
    Feb 3, 2020 at 10:31
  • 12
    @Tim it's not going to be a "repeal everything EU" act, but an "amend every mention of ECJ to SCUK (etc)" act
    – Caleth
    Feb 3, 2020 at 14:11
  • 5
    I think DPA 2018 only contains provisions that complemented GDPR, e.g. for areas that GDPR didn't cover directly rather than incorporating GDPR. That was because GDPR had direct effect as part of EU law. The EU Withdrawal Act 2018 has a concept of "retained EU law" and that's how GDPR will continue to apply (perhaps both now and certainly after the end of the transition period).
    – GS - Apologise to Monica
    Feb 4, 2020 at 12:46
7

While @Greendrake is generally correct that GDPR-like standards (via the Data Protection Act (2018)) will continue to apply to personal data of UK citizens/residents that are controlled or processed in the UK, there is a substantial question about whether the UK will be considered a "safe" jurisdiction for the purposes of the GDPR.

This means that after the Brexit transition period, to control or process in the UK personal data of people "in the Union"* one or more of the following would need to happen:

  1. The UK would need to obtain a formal "adequacy decision" confirming that the UK offers an adequate level of protection for personal data;
  2. the entity controlling or processing EU personal data in the UK would need to establish GDPR-compliant "binding corporate rules"; and/or
  3. the entity controlling or processing EU personal data in the UK would, if it is "established in the Union"** need to enter into appropriate Standard Contractual Clauses*** with the data controller also "established in the Union."

*There is no clear definition of what it means for a person to be "in the Union," but I can't help picturing that scene from Zoolander (look it up if you are too young) where they are trying to get files from "in the computer". That said, the consensus seems to be that this means citizens or permanent residents of the EU.

**The GDPR preamble hints at what it means to be "established in the Union". It certainly does not require being organized under EU law or having a headquarters there, and may not necessarily require having a physical location in the EU; it may be as little as something similar to the US test for nexus to be subject to personal jurisdiction, e.g., purposeful and repeated course of business directed into the EU.

***Recently upheld (generally) by the ECJ: http://curia.europa.eu/juris/document/document.jsf?text=&docid=221826&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=4444395

PS: I am a lawyer, but not your lawyer. Opinions and interpretations are my own and should not be applied to your factual situation without consulting with a qualified attorney who has agreed to advise you on those matters. Phrases in quotes are meant to facilitate your search; I do not have time to pull citations for you.

Improve this answer
2
  • "will continue to apply to personal data of UK citizens/residents" — do you imply that it will not apply to other people in the UK? That's not quite GDPR standards then. What "consensus" are you talking about? A person "in the Union" means just what it says. When I, a New Zealander, physically visit the EU I am not less protected by GDPR than any other person there.
    – Greendrake
    Feb 5, 2020 at 13:09
  • Consensus is too loose a term. Guidance from various attorneys on the issue suggests that a practical, risk-based approach for a controller/processor would be to only treat EU citizens/residents as "in the Union." While you may be able to claim GDPR rights when you are physically present in the EU, enforcement authorities are likely more concerned (sua sponte) with the rights of their citizens/residents than with those of visitors. The DPA imports by reference the definition of "data subject" from the GDPR, so by implication, after Brexit, the DPA should similarly apply to people "in the UK".
    – LawyerOnLinux
    Feb 5, 2020 at 13:36
-3

My understanding from multiple Law firm hosted webinars on GDPR is that it applies to all EU citizens and residents, regardless of where they are in the world. This scope also includes web-sites in other countries that EU citizens and residents visit, even if just browsing and never logging in or any other transactional purchase, because the IP address is considered PII.

So in answer to the question - EU citizens living in the UK are covered. Web-sites that EU citizens (from anywhere in the world) or EU residents (in EU countries) are also required to comply with GDPR. Basically assume that GDPR's overreach will hit you, regardless of where you are.

Improve this answer
3
  • 6
    This understanding is not correct - citizenship is not a factor in Article 3 (Territorial scope). The actual condition in the law is not that long and is relatively straightforward, see gdpr-info.eu/art-3-gdpr . Probably the relevant thing for law firm hosted seminars held in EU and targeted to EU companies is that for EU companies it doesn't matter where or who you are, EU companies are bound by GDPR in all cases even if it's data about a chinese citizen in China.
    – Peteris
    Feb 4, 2020 at 17:36
  • Please read GDPR Recital 23. Just because a website can be accessed in the EU doesn't mean that it's subject to the GDPR. Instead, it matters whether that website specifically targets people in the EU.
    – amon
    Feb 5, 2020 at 7:36
  • 1
    The legal sessions I've received in the United States have all said that GDPR applies to US based web sites that have EU clients (as opposed to simply browsing). They have been mixed on the IP address issue for US based web-sites.
    – Mike
    Feb 5, 2020 at 18:09
-4

!Wrong: as pointed in the comment

GDPR is a directive, not a law itself. It is up to member countries to implement the directive requirements in their own laws using their own legislative process. UK pretty much did that.

The only way for the UK to get rid of GDPR-related stuff in their laws is to complete Brexit and then proceed (if they really want to) to ammend their laws in a way that is incompatible with GDPR.

Improve this answer
3
  • 6
    This is not correct. There are two substantially different types of EU acts, directives and regulations. The General Data Protection Regulation is a EU regulation, it not a EU directive. What you say is true regarding directives, but GDPR is not a directive, and regulations (unlike directives) are binding law directly. See law.stackexchange.com/questions/7853/eu-legal-instruments for example.
    – Peteris
    Feb 4, 2020 at 18:41
  • 1
    @Peteris you are right.
    – fraxinus
    Feb 4, 2020 at 18:45
  • 4
    Since you accept the answer is wrong, you should do one of two things: (a) delete it; or (b) edit it into a correct answer
    – JBentley
    Feb 5, 2020 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .