united-kingdom gdpr european-union brexit
Does GDPR include UK customers, or not anymore?
<p>Now that Brexit happened, does GDPR include UK customers, or not anymore?</p>

<p>GDPR will continue to apply to UK customers directly until the end of the <a href="https://www.bbc.com/news/uk-politics-50838994" rel="noreferrer">transition period</a> (31 December 2020):</p>

<blockquote>
  <p>So, while the UK will no longer have any voting rights, it will need
  to follow EU rules. The European Court of Justice will also continue
  to have the final say over any legal disputes.</p>
</blockquote>

<p>Thereafter, the <a href="https://en.wikipedia.org/wiki/Data_Protection_Act_2018" rel="noreferrer">Data Protection Act 2018</a> will continue to apply (which itself applies "GDPR standards"). Six of one, half a dozen of the other.</p>

<p>While @Greendrake is generally correct that GDPR-like standards (via the Data Protection Act (2018)) will continue to apply to personal data of UK citizens/residents that are controlled or processed in the UK, there is a substantial question about whether the UK will be considered a "safe" jurisdiction for the purposes of the GDPR. </p>

<p>This means that after the Brexit transition period, to control or process in the UK personal data of people "in the Union"* one or more of the following would need to happen: </p>

<ol>
<li>The UK would need to obtain a formal "adequacy decision" confirming
that the UK offers an adequate level of protection for personal
data; </li>
<li>the entity controlling or processing EU personal data in
the UK would need to establish GDPR-compliant "binding corporate rules";
and/or</li>
<li>the entity controlling or processing EU personal data in
the UK would, if it is "established in the Union"** need to enter
into appropriate Standard Contractual Clauses*** with the data
controller also "established in the Union."</li>
</ol>

<p>*There is no clear definition of what it means for a person to be "in the Union," but I can't help picturing that scene from Zoolander (look it up if you are too young) where they are trying to get files from "in the computer". That said, the consensus seems to be that this means citizens or permanent residents of the EU. </p>

<p>**The GDPR preamble hints at what it means to be "established in the Union". It certainly does not require being organized under EU law or having a headquarters there, and may not necessarily require having a physical location in the EU; it may be as little as something similar to the US test for nexus to be subject to personal jurisdiction, e.g., purposeful and repeated course of business directed into the EU. </p>

<p>***Recently upheld (generally) by the ECJ: <a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221826&amp;pageIndex=0&amp;doclang=en&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=4444395" rel="noreferrer">http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221826&amp;pageIndex=0&amp;doclang=en&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=4444395</a></p>

<p>PS: I am a lawyer, but not your lawyer. Opinions and interpretations are my own and should not be applied to your factual situation without consulting with a qualified attorney who has agreed to advise you on those matters. Phrases in quotes are meant to facilitate your search; I do not have time to pull citations for you. </p>
