Brexit

For the past few months, the U.K. has been locked in a bitter stalemate over its departure from the EU. And if England, Scotland, Wales and Northern Ireland leave the EU without a deal, companies could be faced with an extra regulator when handling continental Europeans' data. Plus, any company that currently calls a U.K.-based agency a lead supervisory authority or Article 27 representative will have to find an EU replacement. 

As a member of the EU, the U.K. has been part of the General Data Protection Regulation (GDPR)'s "one-shop-stop" mechanism that allowed one data protection authority to be the lead authority investigating and ruling on local GDPR violations. After the U.K. leaves the European Union, that will no longer be the case.

"'The consequences of a no-deal Brexit is that the ICO [Information Commissioner's Office] will no longer be a part of the one-stop shop," said Gibson, Dunn & Crutcher privacy, cybersecurity and consumer protection practice group co-chair and partner Ahmed Baladi.

Still, Baladi said data protection will still be enforced rigidly in the U.K. after Brexit and the ICO has already confirmed it will amend the country's Data Protection Act post-Brexit.

"The fact that the U.K. is no longer part of the EU doesn't mean data flow is more flexible in the U.K.," he explained. "The U.K. has already adapted the Data Protection Act to implement the GDPR [and companies] will still have to comply with the its provisions. In terms of obligations, it's almost the same." 

Meaning, if a data privacy violation occurs in the U.K and continental Europe, the entity "could face two sanctions, one from the U.K. and EU," Baladi said. "There is no mechanism ensuring consistency between the U.K. [enforcement] approach and the continental European approach."

But if the UK keeps the EU fine regimen, Andrew Dyson, DLA Piper's global privacy group co-chair said noted that a company could potentially face GDPR's significant maximum fine twice.  "You could potentially be exposed to a 4% global company revenue fine in the U.K. and [whichever] other EU country is the lead."

Currently, some lawyers note that the EU and the U.K. are projecting a unified approach to data privacy, especially after the ICO announced a $230 million proposed fine against British Airways and a $124 million fine against Marriott over GDPR violations. But there's a question of if that unity will hold after Brexit. 

"It's likely the U.K. will go one way and Europe will go the other way," Dyson said.

To be sure, Dyson noted that former Prime Minister Theresa May's withdrawal agreement included keeping the U.K. in the one-stop-shop during the transition period before officially leaving the EU. However, her withdrawal agreement has been rejected by the UK parliament on multiple occasions.

In addition to more potential regulatory oversight, a no-deal Brexit may also likely require companies with a U.K.-based lead supervisory authority for enforcing the GDPR to find an EU replacement. Likewise, companies with a U.K. Article 27 representative to act as their direct contact to authorities and customers for GDPR matters, will need a European representative after Brexit, lawyers said.

Dyson also noted along with establishing a different country as their lead authority and representative, the lack of an adequacy assessment from the EU makes some data transfers, risky. According to a released document, the U.K. government is also concerned about the lack of an adequacy assessment from the EU. In its document listing "worst case planning assumptions" of a no-deal Brexit, the U.K. government noted a disruption to "the flow of personal data from the EU where an alternative legal basis for transfer is not in place."