Google to Move UK User Data to the United States
Last week, Google announced its plans to move its British users’ accounts out of EU regulation and into U.S. jurisdiction. Citing uncertainty over Brexit as a reason for the move, Google will no longer provide services to the UK through Google Ireland Ltd, prompting concerns over data protection. Hosting UK user’s data outside of the EU could allow businesses improved access to larger datasets but also significantly weaken commercial and privacy protections.
The move has been prompted over uncertainty on whether or not the UK will continue to follow GDPR after the end of the transition period or if it will adopt new legislation that will affect the management of personal data. Until the end of the transition period, the UK is still required to follow GDPR and the Government are able to request data from Google’s U.S. headquarters. The UK is also currently set to continue to follow GDPR-like legislation under the Data Protect, privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
Google’s decision could help set the ground for the UK Government to justify moving away from the GDPR and ePrivacy regulations in 2021. Amending this Act could ease the administrative burdens on businesses, giving business more leeway to facilitate innovation and potentially safeguard ‘free service’ business models. On the other hand, businesses operating in Europe will be required continue to follow EU regulation regardless and the UK could face increasing consumer mistrust with regard to personal data protection.
For businesses hoping for a broad trade agreement with the United States, Google’s announcement comes as good news. The U.S.’s recently published Cloud Act should ease British authorities’ ability to obtain data from U.S. companies, giving the UK a competitive advantage over the EU.
In the meantime, Google has informed UK-based business users that the ‘terms don’t affect the rights [they] have as a business user under the EU Platform-to-Business Regulation’. Should any UK-based business object to the change, they may refer to Google’s advice that, ‘if you don’t agree to the new terms, you should remove your content and stop using the services. You can also end your relationship with [Google] at any time by deleting your Google Account.’
As other tech giants are due to make similar choices soon, businesses should continue to monitor developments and measure the Government’s mood on privacy deregulation.