Updated April 21, 2021.
The UK left the EU on January 1, 2021.
But what happens now to the EU’s GDPR and the UK’s domestic data privacy laws?
Read this article to know more about the EU’s GDPR, the “new UK-GDPR”, the amended Data Protection Act 2018, the PECR and how to be compliant all around.
Since the UK has left the EU, the question of personal data transfers is top of the list for many websites, companies and privacy organizations.
In the agreement signed by the UK and EU in end of December 2020, a provision allows for the continued, unrestricted flow of data between the two blocs for an interim period of six months (until June 2021).
In February 2021, the European Commission released a draft UK adequacy decision, which would grant the United Kingdom adequacy status under the General Data Protection Regulation (GDPR) if approved, securing a free low of data between the two blocs for the future.
The draft decision is remarkable and unlike previous adequacy decision granted to countries like New Zealand and Canada because it is time limited to four years. A renewal in 2025 would depend on whether the UK still provides an adequate level of data protection.
In April 2021, the European Data Protection Board (EDPB) released an opinion in which they welcome the EU Commission’s draft adequacy decision and agrees with the time-limit of four years for close monitoring of data protection developments in the UK.
Additionally, the European Parliamentary Research Service (EPRS) has released a report on the prospects of a UK adequacy decision and EU-UK private sector data flows after Brexit.
Compliance with the UK-GDPR and EU’s GDPR remains an obligation for any website, company or organization who process personal data form either inside the UK or EU: the explicit consent of users must be obtained before any processing or transfer is allowed to take place.
Being compliant with the EU GDPR, the new UK-GDPR and the supporting data protection legislations such as the Data Protection Act 2018 might seem a tad confusing, what with all the other messy stuff that comes with Brexit.
Cookiebot CMP is the world-leading GDPR compliance solution for websites of all shapes and sizes.
Built around a powerful scanner that detects all cookies, trackers and trojan horses, Cookiebot CMP gives your users automatic control of their personal data, in full compliance with the requirements of both the EU and UK data privacy regime.
Cookies are one of the most common ways that websites process personal data, so it’s super important in terms of data law compliance to both know what cookies are active on your website and to enable your end-users with a choice of prior consent as to which cookies they want active, when visiting your domain.
By simulating visitors on your website – scrolling, clicking, exhausting all possible uses of your domain – Cookiebot CMP detects trackers present, both first party (your own website’s) and third party (usually marketing cookies from ad tech companies that are privacy invasive).
With highly customizable consent banner and automated geo-targeting, Cookiebot CMP takes the hard part out of being compliant with the world’s major data privacy laws.
Try Cookiebot CMP free for 30 days – or forever if you have a small website.
The General Data Protection Regulation (GDPR) is an EU law that took effect in May 2018 and is uniformly binding in all 27 EU nations. It controls how companies and organizations are allowed to handle personal data.
Personal data is defined in the GDPR as anything that can be directly or indirectly identified to a natural person, such as names, physical addresses, IP addresses, location data, and information about physical, mental, economic, cultural or social facts.
Sensitive personal data, however, is defined by the GDPR as data about religious convictions, political opinions and/or sexual orientation.
The GDPR protects the personal data of individuals inside the EU.
The GDPR clarifies in total eight rights for individuals, including the right to request access to one’s data (a so-called Subject Access Request or SAR), as well as to request their personal data deleted.
However, the most important right that the GDPR empowers EU citizens with is the right to not have their data (personal or sensitive) collected and processed without prior consent.
Here, the GDPR requires websites to -
This is the backbone of GDPR compliance.
In doubt whether your website is GDPR compliant? Test with Cookiebot's free compliance test.
Try Cookiebot free for 30 days... or forever if you have a small website.
The United Kingdom has been regulated by the European GDPR since it took effect in May 2018.
Upon leaving the EU on January 1, 2021, the UK is officially not a part of the EU’s GDPR any longer, i.e. the EU’s GDPR does not have any domestic jurisdiction in the UK as it had from May 2018.
The UK has passed its own version called the UK-GDPR, which alongside the Data Protection Act of 2018, is in effect now.
The new UK-GDPR is essentially the same as its European predecessor, only revised so as to cover areas of the domestic law that are not touched upon by the EU regulation. These include among others national security, the intelligence services and immigration.
Even though the UK has left the EU, a provision in the agreement between the two blocs ensures an interim period of six months (until June 2021), in which personal data can flow unrestricted between UK and EU, just as before.
By implementing the GDPR into domestic law, the UK ensures an adequate level of data protection that can secure future, unrestricted data flows, if the EU grants the UK a so-called adequacy decision before June 2021.
The Information Commissioners’ Office has several data laws to enforce in the UK.
After Brexit on January 1, 2021, the following data laws has taken effect in the UK:
PECR is the UK’s national implementation of the European ePrivacy Directive. It deals with the protection of personal data in relation to electronic communications, specifically cookies and online marketing communications.
Since it’s a national implementation, i.e. a domestic UK law, the PECR will still apply after Brexit.
ICO enforces PECR, DPA2018 and the new UK-GDPR.
ICO has ruled that the only form of valid consent on websites are consents given prior to the initial tracking, obtained through cookie banners without any pre-ticked checkboxes.
Website owners and operators are no longer allowed to collect or process personal information if users simply close a cookie banner or choose to keep browsing on a site after the popping up of a cookie banner.
Instead, users must affirmatively consent by clicking and ticking the boxes of all categories of cookies apart from the strictly necessary ones on which a website functions.
This is how a compliant cookie banner in the UK looks, according to the new guidelines by the ICO.
While the UK was still a part of the European Union, it was the responsibility of the Information Commissioner’s Office (ICO) to enforce the EU's GDPR on UK soil.
However, since the UK is no longer an EU member state, the main responsibilities of the ICO will now be to enforce its own domestic version, the UK-GDPR, and the supporting Data Protection Act of 2018.
The EU's GDPR is enforced by the national data protection authorities (so-called DPAs) in each EU nation, although special responsibility and power falls to the Irish DPA for being the lead regulator of the GDPR in EU.
This is because a provision in the GDPR specifies that the law’s lead regulator must be the DPA of the country that houses a tech company’s data controller, which is the case for Ireland when it comes to both Facebook and Google.
ICO is the data authority and enforcer of the GDPR in the UK.
ICO is the enforcer of the GDPR in the UK with the power to conduct criminal investigations and issue fines, as was witnessed last year when it raided the offices of Cambridge Analytica, the disgraced data firm that abused the personal information of 87 million people, obtained through Facebook, to influence both British and US elections.
According to the GDPR, UK websites and companies who fail to comply with its requirements can be fined up to €20 million or four percent of a company’s annual global turnover, whichever is greater.
So far the GDPR fines in UK vary a lot in form and strength.
ICO has enforced the GDPR in the UK on numerous occasions already.
A lot of the monetary penalties issued by ICO a year after the date of effect of the GDPR in the UK center around unsolicited direct marketing, which is unlawful according the to GDPR. Prior consent from its customers or users is required before a company or website can undertake direct marketing.
ICO has stated that it prefers to work with organizations to improve their practices, rather than seeking maximum fines.
Its GDPR enforcement has so far taken shape as monetary penalties, but also guidance to companies and organizations in order to improve their practices and sometimes “a stern letter can be enough”, ICO stated.
If you process personal data of individuals in the UK, you must comply with the GDPR, the Data Protection Act 2018 and the PECR.
Cookiebot CMP enables full compliance all domestic UK data privacy laws and the EU's GDPR.
Try Cookiebot CMP free for 30 days - or forever if you have a small website.
So, to sum up -
An interim period of six months (until June 2021) is in place, ensuring the free flow of personal data between the UK and EU – just as when the GDPR was applicable to the UK before Brexit.
It is expected that the EU will grant an adequacy decision and make unrestricted data flow a default between the UK and EU.
After Brexit, the new UK-GDPR is in effect domestically in the UK and means the same data protection and requirements apply as before under EU law.
The ICO is the lead enforcer of the UK-GDPR, Data Protection Act of 2018 and PECR.
An amended version of the Data Protection Act 2018 took effect on January 31, 2020.
PECR is a domestic law in the UK regulating electronic communication and continues to apply after Brexit.
The EU’s General Data Protection Regulation applies to any processing of personal data from individuals inside the European Union, but after Brexit, will no longer apply to the processing of personal data from individuals inside the UK. After Brexit, the new UK-GDPR applies domestically in the UK and is the equivalent of the EU’s GDPR.
The Information Commissioner’s Office (ICO) is the lead supervisory body and enforcer of the UK-GDPR. The ICO has the power to conduct criminal investigations, adopt guidelines and issue fines for non-compliance.
Personal data is anything that can be used to identify a living individual, either directly or indirectly. Personal data includes names, addresses, driver’s license, passport number, health data, location data, information about religious beliefs and political convictions, but also cookies, IP addresses, search and browser history.
Try Cookiebot CMP free for 30 days – or forever if you have a small website.
Cookies are difficult to control – many cookies will secretly load other cookies, and many of those will change on repeated visits. Using a consent management platform can help your website control its cookie setup and ensure compliance with data privacy laws like the EU’s GDPR and UK-GDPR.