ICO says GDPR will be in force before Brexit

The UK’s Information Commissioner Elizabeth Denham has said the General Data Protection Regulation (GDPR) will come into effect before Britain leaves the European Union.

“It is extremely likely that GDPR will be live before the UK leaves the European Union. Remember that the GDPR is actually already in force, it is just that member states are not obligated to apply it until 25 May 2018,” she said.

Denham however admitted that Brexit has thrown a spanner in the works in the way the UK carries out data protection legislation.

“The Referendum result has thrown our data protection plans into a state of flux,” she said, noting that evolution in technology mirrored by intolerance of data abuses requires the UK’s current Data Protection Act to be modernised.

“What hasn’t changed are the strong data protection rules the UK already has. We need those rules to ensure cross-border commerce, not to mention the privacy protections citizens and consumers expect,” Denham added.

If GDPR comes into effect before Britain Brexits, then UK companies who are involved in handling data will need to conform to it regardless of how soon the UK might leave the EU.

As such, it would make sense for Britain to enshrine GDPR into its own data protection laws. Given Denham’s stance on the controls GDPR brings, that situation appears to be rather likely.

“GDPR brings in new elements – and a more 21st century approach – the right of consumers to data portability is new, as is mandatory data breach reporting, higher standards of consent, and significantly larger fines for when companies get things wrong,” she said.

“But the major shift in the law is about giving consumers control over their data. It ties in with building trust and is also part of the ICO’s philosophy.”

Denham noted that given many UK businesses carry out trade with Europe, the need to comply with the GDPR is inevitable.

“The fact is, no matter what the future legal relationship between the UK and Europe, personal information will need to flow. It is fundamental to the digital economy. In a global economy we need consistency of law and standards – the GDPR is a strong law, and once we are out of Europe, we will still need to be deemed adequate or essentially equivalent,” she explained.