Construction Leadership Council Issues Brexit Data Protection and GDPR Guide

THE BREXIT WORKING GROUP of the Construction Leadership Council has published a guide to help companies manage their data protection and General Data Protection Regulation (GDPR) compliance.

The guidance comes ahead of the UK’s exit from the transition period with the European Union, at the end of the year.

GDPR applies to all companies based in the EU and those with EU citizens as customers. It has an extraterritorial effect, so non-EU based companies that operate in the EU must also comply with the GDPR.

European GDPR

Even though the UK has left the EU and is in a transition period, UK companies will still need to comply with European GDPR rules. This is due to it being likely that they offer goods or services or monitor individuals in the EU.

Currently, the GDPR is incorporated into UK law and ministers have not indicated that this situation will change. However, it is likely that in the future, the UK and EU’s GDPR will diverge and so businesses will need to consider ensuring they keep abreast of both UK and EU data laws.

The guide supports businesses to understand the challenges faced and offers solutions via recommendations for action and additional resources.

With thought given to every possible scenario, the guide prompts action on the following themes:

• Using Brexit as an opportunity to review and update data inventories or Records of Processing Activities
• Considering relationships and agreements with third party processors
• Regularly reviewing government guidance here

The guidance was produced under the stewardship of Amy Chapman, Group Legal Director of MACE and Celia Carlisle, General Counsel of Tideway.

Amy Chapman, Group Legal Director of MACE commented: “Currently the data protection situation after the transition period is uncertain. This is while we wait to see if the EU will agree that the UK’s current data protection rules are ‘adequate’.

“The CLC’s newly published guide seeks to highlight the main issues and suggest what businesses can do during the transition period to protect themselves in the event that no adequacy agreement is reached by 31 December 2020. It is a complex area and the note also points our industry colleagues towards where they can find further advice.”

Access to the guide is here.