Just as the dust is finally settling following the introduction of the General Data Protection Regulations 2018 (“EU GDPR”) in May last year, the government published, on 19 December 2018, the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“the Regulations”).
The Regulations seek to make amendments to the UK data protection legislation framework to ensure functionality after Brexit.
The EU GDPR, which the UK is bound by until at least 29 March 2019, or exit day, contains many references to EU laws, institutions, currency and powers which will cease to be relevant in the UK after Brexit. The Regulations, therefore, aim to address these references and replace them with British equivalents, in order to introduce what will be known as the UK GDPR. The UK GDPR will create a single regime for general processing that applies after exit day, by merging the EU GDPR and the applied GDPR introduced by the Data Protection Act 2018.
The Regulations will also amend the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) to include the EU GDPR definition of consent and preserve the extra-territorial applicability of the EU GDPR to cover controllers and processors outside the UK in certain circumstances. This means that controllers or processors outside the UK, but processing the personal data of UK residents, will be covered by UK GDPR and will extend to controllers and processors both in and outside the European Economic Area.
What happens in the event of a no-deal Brexit?
The European Union (Withdrawal) Act 2018 is the main statutory instrument used to introduce the Regulations, as they allow a minister to address deficiencies in retained EU law following withdrawal. The Act mainly addresses a no-deal scenario (where there is no agreement and no transition period) and therefore takes a snapshot of retained EU law as it stands before exit day. If there is no-deal, this will be the position.
What happens if there is a deal?
If there is a deal, most EU law will continue to apply in the UK during the transition period and so any amendments will need to be updated to reflect the position at the end of the transition period. This means that any statutory instruments laid in preparation for Brexit may not be needed until the end of the transition period and may need to be amended or deferred to take this into consideration.
The amendments to PECR (to include the new definition of consent) will come into force on the 29 March 2019, irrespective of whether there is a transitional period.
If you have questions about this blog and would like to speak to someone about them, please contact our Clarion Commercial Team.
Disclaimer: Anything posted on this blog is for general information only and is not intended to provide legal advice on any general or specific matter. Please refer to our terms and conditions for further information. Please contact the author of the blog if you would like to discuss the issues raised.