Brexit: ICO Says GDPR Will Come Into Effect Before Britain Leaves The EU

The UK’s Information Commissioner Elizabeth Denham has said the General Data Protection Regulation (GDPR) will come into effect before Britain leaves the European Union.

“It is extremely likely that GDPR will be live before the UK leaves the European Union. Remember that the GDPR is actually already in force, it is just that Member States are not obligated to apply it until 25 May 2018,” she said.

The result of the EU referendum coming out in favour of Britain leaving the Union will in practice take two years once Article 50 has been invoked, something the government has yet to do or show any sign of doing.

Brexit and GDPR

However, Denham said the Brexit does throw a spanner in the works for the way the UK carries out data protection legislation.

“The Referendum result has thrown our data protection plans into a state of flux,” she said, noting that evolutions in technology mirrored by intolerance of data abuses requires the UK’s current Data Protection Act to be modernised.

“What hasn’t changed are the strong data protection rules the UK already has. We need those rules to ensure cross-border commerce, not to mention the privacy protections citizens and consumers expect,” Denham added.

If GDPR comes into effect before Britain Brexits, then UK companies involved in handling data will need to conform to them regardless of how soon the UK might leave the EU after GDPR comes into effect.

As such, it would make sense for Britain to enshrine the GDPR into its own data protection laws. Given Denham’s stance on the controls the GDPR brings, that situation appears ot be rather likely.

“GDPR brings in new elements – and a more 21st century approach – the right of consumers to data portability is new, as is mandatory data breach reporting, higher standards of consent, and significantly larger fines for when companies get things wrong,” she said.

“But the major shift in the law is about giving consumers control over their data. It ties in with building trust and is also part of the ICO’s philosophy.”

Denham noted that given many UK businesses carry out trade with Europe, the need to comply with the GDPR is enevitable.

“The fact is, no matter what the future legal relationship between the UK and Europe, personal information will need to flow. It is fundamental to the digital economy. In a global economy we need consistency of law and standards – the GDPR is a strong law, and once we are out of Europe, we will still need to be deemed adequate or essentially equivalent,” she explained.

“For those of you who are not lawyers out there, this means there would be a legal basis for data to flow between Europe and the UK.”

The Information Commissioner’s Office (ICO) has previously stated that the future of the UK’s data protection regulations need to equal those of the GDPR, yet at the same time the ICO has said that there are other data regulation policies around the world it could enshrine and enforce in order to be acceptable for citizens’ privacy.

How much do you know about the European Commission? Take our quiz!