What will the UK’s departure from the European Union do to the UK’s data protection regulations and therefore our responsibilities as researchers handling data? This is as yet unknown as the UK have not yet decided which European legislation they will retain and what will need to be relegislated for by the UK judiciary. This is further complicated by the plans which were initiated prior to the UK Referendum and decision to leave the EU to replace the Data Protection Act 1998 with General Data Protection Regulation (GDPR). The GDPR was adopted by the European Parliament in April 2016 and is intended for adoption throughout EU member states by 2018 ie. before BREXIT negotiations complete. This was noted as an issue by lawyers and data protection experts prior to Article 50 being invoked eg. Hasan (2016) Data protection and BREXIT and since eg. the week in March Tim Barrow handed in Theresa May’s letter to Donald Tusk, as President of the European Council (Lee, 2017) The Future of Data Protection Law Post-Brexit and more recently eg. Mullock and Shooter (2017) Brexit: Data Protection and Cyber-Security Law Implications.

Data protection expert Phil Lee (partner in the Privacy, Security and Information law group) summarised the likely process which will need to take place with regard to retaining data protection regulation. “The UK government has signalled that, in order to provide continuing legal certainty for citizens and businesses, all existing European law will essentially be “copied and pasted” into UK law in time by the time the UK leaves the EU” (Lee, 2017). He goes on to say that… “The Great Repeal Bill …aims to give the UK government the power to adopt secondary legislation (i.e. laws that are aren’t subject to full Parliamentary scrutiny and so are more quickly and easily adopted) that will ‘tweak’ the converted EU laws in a way that ensures they will have meaning in the UK” (Lee, 2017) and that we need to hope that we are considered by the EU to be an ‘adequate’ country “meaning it can freely send and receive data back and forth with the EU” (Lee, 2017)

James Mullock and Simon Shooter (Partners in the UK firm Bird and Bird) suggest that options will be to “put the UK in the position of having to adopt either EU strength data protection laws (to join countries such as Canada as benefiting from an adequacy decision), or an EC approved data transfer mechanism (as the USA is currently seeking to do via the EU-US Privacy Shield)” (Mullock and Shooter, 2017).

As well as our research within EU contexts there are also other aspects of the current Data Protection Act 1998 and forthcoming General Data Protection Regulations which researchers will need to look out for changes in, for example, if collecting data in non-EU (as currently referenced in Schedule 4 of the Data Protection Act) contexts…Phil Lee’s article offers a good summary of the key changes expected in the GDPR.

As, in July 2017, we are only in the early stages of negotiations with the EU, focusing on EU agendas which need to be agreed sufficiently to be able to move forward into more bilateral discussions, it would be worth keeping a weather eye out for what happens to the GDPR and what this might mean for us as researchers wanting to ensure we collect, store and use data responsibly.