GDPR post Brexit: How will this impact hosting and cloud providers?

By: Güneş Ilgüy, Head of Data Protection at A City Law Firm

The UK needed to upgrade its data privacy laws and bring it in line with the rest of the world. The main reason for the GDPR was to assist in harmonising the data privacy laws across Europe, setting a standard that the nations could adhere to.

The GDPR was exactly that change. It was designed to ensure that a high standard was implemented, a code if you like, for businesses to be held more accountable for the data they collect and process. It also gave more power to the people by allowing them to have a say in how their data can be used.

The question remains however: Will GDPR still be relevant post Brexit?

In England and Wales, The Data Protection Act 2018 (DPA) came into force replacing the old one of 1998. The DPA mirrors the GDPR and where the GDPR is vague in some areas, the DPA adds more meat to the bone.

Also, remember, the GDPR applies to all EU member states and any business collecting data of an EU national has to be GDPR compliant. It is also worthy of noting how far the GDPR reaches out in the international community. Any data processing by businesses outside of the EU, who process the personal data of individuals in the EU, are also subject to the GDPR.

The Information Commissioner has stated that the GDPR “will send an important signal about the UK’s commitment to a high standard of data protection post-Brexit. This in turn will play a role in ensuring uninterrupted data flows between the UK and the EU.”

The position of the UK post Brexit

The GDPR is a directive and whilst the UK is still a member of the EU, it had a duty to implement this directive into domestic law. The DPA allows the UK to hold itself up to the same standard as the GDPR. It is not likely that the UK will now abandon the GDPR and amend its own laws, given the amount of money public bodies and businesses have invested into ensuring they are compliant. Changing the law would not make sense given that it has been brought up to date and implemented, with businesses winning over their customers.

Keeping its current law in line with the GDPR will also pay dividends post Brexit as businesses will hope to maintain good relations with their EU counterparts.

Hosting companies and Cloud providers

Online data collection is probably most popular method of collecting data. Hosting companies and cloud providers have spent a lot of time and money ensuring that they can meet the demands of being compliant in terms of providing server security and processing data they handle.
Data transfer in itself does not have any boundaries. There is some uncertainty of how the UK will react to data privacy post Brexit however it would not make sense to go backwards and change the current regime to render it incompatible with the GDPR. Developing strong ties with the EU in the terms of trade is of utmost importance and any change post Brexit will not be welcomed by companies.

Hosting and cloud providers, as data controllers or processors, have already been pushed to ensure they operate in line with the GDPR by their customers. If there was to be a different standard implemented by the UK, this could see UK providers losing customers to EU based providers who will be able to conform to the standards needed.

Companies outside of the UK are also looking at the current market. Where they have business
operation in the UK, they are likely to use UK hosting companies. Post Brexit, using UK based hosting services might be more cost effective, depending on the value of the pound sterling, as opposed to using EU hosting providers who may look to increase the price of their services.

One case that makes the crossover unclear is the Google Breach – in the future Post-Brexit can this scenario arise? As surely the reach of an EU country into the UK to this extent will no longer apply? There is no answer to this question, but it is something to watch

The French Data Regulator, CNIL, fined Google a record £44 million (50 million Euros) for breaching the EU’s data protection laws. This made headline news because what makes this case remarkable is that the complaints against Google in May 2018 were raised by two privacy rights groups in France, and against a company whose headquarters were and are based in Ireland.

Generally, you would expect the Irish regulator to have addressed this however, the CNIL found that the overarching decisions about the processing operations complained of were not made by Google’s Irish offices, or by anyone in the EU. It was discovered those were made by the US company. As this case was not about a data controller’s main EU establishment, CNIL was at liberty to take its own action. This conclusion was reached following communications with other EU supervisory authorities, including the Irish DPC.

What can be learned from this?

The Google case sends a strong message about data protection which should be received loud and clear. Regulators have powers to levy huge fines on companies found to be in breach and they are willing to use it even outside of the companies housed jurisdiction. whether an EU country would have this right post Brexit is something to watch?

Conclusion

Focus is now on how an effective deal can be negotiated however any hard Brexit or no deal will have consequences on the economy, and this will affect how business choose to operate. It is hoped that the current data legislation is adequate enough not to be changed or significantly amended. Any changes that are incorporated would mean businesses in the UK and EU would need to adapt to ensure they maintain their customer base. What happens after Brexit is anyone’s guess.

Under EU regulations an EU based data controller has to ensure that when data is passed to a country outside of the EU (which the UK will be upon Brexit even to Ireland) that the country housing the data has adequate levels of protection comparable to those of the EU.

Whilst we don’t expect a significant shift given the UK is currently having to comply with GDPR and its own Data Protection legislation so harmonized, we do not know how the EU will view this in the future, especially since at the time of writing we may still be looking at a ‘hard Brexit’. It is likely EU based controllers will have to deal with the UK as it does for any non-EU countries – with established data protection mechanisms in place, such as the United States.