0

This question was inspired by this question on Security.SE, regarding a data breach in a UK-based company.

In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK is still part of the European Union, it is therefore still affected by the GDPR, and may be legally responsible to report a data breach.

One person commented, that said company would only be affected by the GDPR, until the UK would leave the European Union.

Inspired by this, I would like to present a hypothetical situation, in which a UK-based company had a data breach while still affected by the GDPR, but chose not to report it, because that situation would change soon.

However, the relevant offices were informed of the alleged breach, and began conducting an investigation. During this investigation, the UK leaves the EU in a way that EU laws and regulations would not apply to the UK anymore.

If that investigation were later come to the conclusion that the company would have been required to report the breach, would the EU have the right to fine the offending company?

Improve this question
2
  • What "relevant offices"?
    – Martin Bonner supports Monica
    Commented Aug 14, 2019 at 16:46
  • @MartinBonner: Under the GDPR, each EU country has to designate a national authority. As a UK company, the British authority (ICO) would be the first to notify; possible (depending on details) there would be a need to notify other GDPR authorities in other countries.
    – MSalters
    Commented Aug 15, 2019 at 9:48

2 Answers 2

Reset to default
2

This is an interesting question. The general rule in common-law systems is that the law at the time of the alleged offense applies, unless the law that makes a change explicitly provides otherwise. So this might depend on the exact terms of the parliamentary action by which the UK withdraws from the EU.

However, it is worth noting that the GDPR applies, or at least purports to apply, to non-EU entities which are processing data of people who are in the EU. The hypothetical UK company would still come under that provision, although it is unclear, at least to me, how this would be enforced.

By the way, my understanding is that in EU member states fines are imposed by national authorities, so if any fines were to be imposed under the GDPR in this hypothetical case, they might well be imposed by the UK, not the EU.

Improve this answer
4
  • 1
    Also there is no indication that the Data Protection Act 2018 will be repealed. Section 67 obliges UK data controllers to notify the UK's Information Commissioner's Office within 72 hours of becoming aware of a personal data breach likely to result in a risk to the rights and freedoms of individuals. The ICO can apply a significant civil monetary penalty.
    – Lag
    Commented Aug 14, 2019 at 18:55
  • 1
    “Purports to apply” - there’s no “purports” about it, extra-territorial jurisdiction has the full support of international law. A country’s law applies everywhere they say it does. This may give rise to difficulty in enforcement but the applicability is not in doubt.
    – Dale M ♦
    Commented Aug 14, 2019 at 20:02
  • Also, "When the UK exits the EU, the EU GDPR will no longer be law in the UK. The UK government intends to write the GDPR into UK law, with the necessary changes to tailor its provisions for the UK (the “UK GDPR”). The government has published a ‘Keeling Schedule’ for the GDPR, which shows the planned amendments." ico.org.uk/for-organisations/data-protection-and-brexit/…
    – Lag
    Commented Aug 15, 2019 at 8:58
  • The GDPR is a European directive that put an obligation on the UK to implement the GDPR provisions in national (UK) law. After Brexit, the UK is no longer obliged to keep this law on the books, but by default laws continue to exist until explicitly invoked.
    – MSalters
    Commented Aug 15, 2019 at 9:52
0

In this situation, EU regulations will cease to be law in the UK the minute that the UK leaves the EU. However, the UK has been preparing for this and at the same moment, all those regulations should be replaced with UK laws (properly modified where necessary). So assuming the UK can get their act together, everything will stay the same.

EU directives on the other hand are not law, but all member states of the EU are supposed to create their own laws implementing the EU directives. These laws are UK laws today, and they will stay UK laws.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .