31.10.2023 employer of record

In April 2016, the General Data Protection Regulation (GDPR) was adopted by the European Union (EU), establishing a legal framework that outlines regulations for the collection and processing of personal information belonging to EU citizens.

Implemented two years later, the primary objective of the GDPR is to enhance the control and rights of individuals over their personal data. It sets standards for accountability, security, and transparency in the utilization of private information.

In June 2016, shortly after the approval of the GDPR, the United Kingdom conducted a referendum, commonly referred to as the Brexit referendum, where 51.9% of the voters chose to exit the EU. To prepare for Brexit, the UK Parliament enacted the European Union (Withdrawal) Act 2018, which incorporates various EU regulations into domestic law.

The GDPR was integrated into UK domestic law until the conclusion of the Brexit transition period on December 31, 2020, at which point it was replaced by the UK GDPR.

The UK GDPR, in conjunction with the Data Protection Act of 2018 and the Privacy and Electronic Communications Regulations (PECR), regulates all personal data processing activities concerning individuals within the United Kingdom. Although the UK GDPR closely aligns with the EU GDPR, there are noteworthy distinctions between the two.

For businesses operating in both markets, it is crucial to be cognizant of these disparities to ensure compliance with the GDPR.

The Main Differences

Applicability

The EU GDPR possesses extraterritorial reach, extending its jurisdiction to encompass any organization, whether situated inside or outside the EU, that engages in the processing of personal data belonging to individuals located within the EU. This broad scope ensures that personal data protection is not confined solely to EU-based entities.

Conversely, the UK GDPR exhibits a more limited applicability. Its primary scope covers organizations based within the UK and those entities operating outside the UK but handling the personal data of individuals within the UK.

For businesses exclusively conducting operations within the UK, adherence to the UK’s version of the GDPR is imperative. Conversely, businesses exclusively operating within the EU must adhere to the EU GDPR. In the case of businesses operating within both the UK and the EU, compliance with both iterations of the GDPR is obligatory.

Supervisory Authorities

One of the prominent distinctions between these two regulatory frameworks lies in their approach to supervisory bodies. In the European Union (EU), each member state is mandated to establish one or more supervisory bodies tasked with monitoring the implementation of the General Data Protection Regulation (GDPR) within their respective territories. These supervisory bodies bear several responsibilities, including:

• Furnishing guidance and counsel to both organizations and individuals concerning their obligations and rights pertaining to data protection.

• Receiving and investigating grievances from data subjects who suspect potential infringements of their rights under the GDPR.

• Carrying out inquiries into organizations’ data processing practices, which encompass activities like audits, on-site inspections, and the requisition of information.

• Imposing administrative fines and penalties on organizations found in contravention of GDPR provisions.

Furthermore, in addition to these supervisory bodies at the member state level, the EU GDPR operates under the auspices of the European Data Protection Board (EDPB). The EDPB’s role is to ensure the uniform application of the GDPR across the EU, provide guidelines, mediate disputes among supervisory bodies, and foster cooperation among them.

In contrast, in the United Kingdom (UK), there exists a single entity responsible for the oversight and enforcement of data protection: the Information Commissioner’s Office (ICO).

The ICO wields functions and powers akin to those of the supervisory bodies operating under the EU GDPR. Although it operates as an executive non-departmental public body, the ICO receives sponsorship from the Department for Science, Innovation, and Technology.

Adaptions to the UK’s legal framework

When the United Kingdom introduced its adaptation of the GDPR, it aimed to preserve the high data protection standards set by the European Union (EU) while making specific adjustments to harmonize with the UK’s legal framework.

Consequently, the UK GDPR includes the majority of provisions found in the EU GDPR, but it incorporates particular alterations and exceptions to suit the unique circumstances of the UK.

These adaptations and exceptions within the UK GDPR are evident in various aspects, including:

References to EU entities: The UK GDPR substitutes references to EU entities like the European Commission and European Data Protection Board with suitable UK counterparts. This ensures that the UK GDPR operates within the framework of the UK’s legal system.

Data protection standards: While the core principles and data subjects’ rights remain largely consistent, the UK GDPR diverges from the EU GDPR in specific areas, such as requirements for reporting data breaches, the appointment of data protection officers, and exemptions for particular public authorities.

Collaboration with EU Supervisory Authorities: The UK GDPR establishes mechanisms for collaboration and alignment with EU Supervisory Authorities. It delineates procedures for mutual support, joint activities, and the exchange of information between the UK’s Information Commissioner’s Office (ICO) and EU Supervisory Authorities.

Transfers of personal data

Under the EU GDPR, the free flow of personal data among EU member states is permitted without the need for supplementary safeguards. This principle is rooted in the concept of the “single market” within the EU, which allows for the unrestricted movement of goods, services, and data.

Organizations located within the EU can transmit personal data to other EU member states as long as they adhere to the general data protection principles and have established a data processing agreement (DPA) in accordance with the requirements stipulated in the EU GDPR.

However, following the UK’s departure from the EU, the UK is now treated as a distinct jurisdiction under the EU GDPR. Consequently, the transfer of personal data from the EU to the UK is regarded as a transfer to a “third country” outside the EU, akin to data transfers to nations like the United States or Canada.

Consequently, additional safeguards may be necessitated for the transfer of personal data from the EU to the UK. These safeguards are essential to guarantee that the transferred data continues to receive a level of protection comparable to that provided by the EU GDPR.

Organizations within the EU must adhere to the specific mechanisms or tools authorized by the EU GDPR for transferring data to third countries. These mechanisms include the use of standard data protection clauses or binding corporate rules to facilitate data transfers to the UK.

EU representatives

The EU GDPR mandates that organizations located outside the EU must designate an EU representative if they process the personal data of EU residents. This EU representative must be established within the EU member states where the data subjects, whose data is being processed, are situated.

This requirement ensures the existence of a contact point for data protection authorities and individuals within the EU, facilitating communication and addressing data protection concerns.

Conversely, the UK GDPR introduced a distinct provision for organizations situated outside the UK that process the personal data of UK residents. These organizations are obliged to appoint a representative in the UK. However, in contrast to the EU GDPR, the UK GDPR does not necessitate that the representative be physically located within the UK.

The discrepancy in the location requirement for the representative under the UK GDPR aligns with the UK’s objective of allowing flexibility while still ensuring the presence of a designated point of contact for the Information Commissioner’s Office (ICO) in matters related to data protection.

This flexibility enables organizations to designate representatives who may function remotely, provided they effectively fulfill their responsibilities and comply with the requirements of the UK GDPR.

It’s important to note that organizations subject to both the EU GDPR and the UK GDPR might need to appoint separate representatives, contingent on their data processing activities and the involved jurisdictions.

The one-stop-shop (OSS) mechanism

The one-stop-shop (OSS) mechanism is a distinctive feature of the EU GDPR that impacts organizations engaged in cross-border data processing activities within the EU.

Under the OSS, when an organization operates across multiple EU member states and conducts cross-border data processing, it can primarily collaborate with a Lead Supervisory Authority (LSA) situated in the same Member State as the organization’s primary establishment, typically its EU headquarters.

The OSS mechanism significantly streamlines the compliance process, allowing organizations to address privacy-related matters across borders from their home base and communicate with a single Supervisory Authority. This simplifies the process compared to engaging with multiple authorities in each jurisdiction where they operate.

However, it is crucial to understand that the OSS mechanism does not exclude the involvement of other supervisory authorities in the EU.

Other Supervisory Authorities, known as concerned Supervisory Authorities, still play a role in the process and can offer input and participate in decisions that impact individuals within their respective jurisdictions.

In contrast, the UK GDPR lacks an equivalent OSS mechanism. Instead, the Information Commissioner’s Office (ICO) holds full and direct responsibility for all aspects of UK data protection regulation, serving as the sole Lead Supervisory Authority.

 Amendments and updates

Under the EU GDPR, any alterations or revisions to the regulation are subject to the EU legislative process.

This process encompasses various stages, including proposals put forth by the European Commission, negotiations and deliberations among the EU member states and the European Parliament, and eventual adoption through the relevant EU legislative bodies.

This signifies that modifications to the EU GDPR necessitate a collective decision-making process involving multiple stakeholders from diverse member states.

The EU legislative process guarantees a unified and harmonized approach to data protection throughout the union, as any changes or updates to the regulation undergo a thorough assessment and consultation process.

It also allows for input from a range of perspectives, including input from legal experts, data protection authorities, and other pertinent stakeholders.

In contrast, the UK GDPR grants the UK government the authority to make independent adjustments or amendments.

This autonomy provides the government with the flexibility and adaptability to respond to specific circumstances and modify the UK GDPR as required, considering the evolving data protection landscape, emerging technologies, or any specific considerations linked to the UK’s legal framework and national interests.

Nevertheless, it is important to emphasize that while the UK has the capacity to independently amend the UK GDPR, it still strives to uphold a high standard of data protection that closely aligns with the EU GDPR.

This alignment ensures a degree of consistency and compatibility between the data protection frameworks in the UK and the EU, thereby facilitating data transfers and cooperation between these two jurisdictions.

Data protection exemptions

The UK GDPR incorporates provisions that grant organizations, especially those involved in national security, immigration control, or intelligence services, the authority to depart from specific data protection obligations.

For instance, concerning national security, the UK GDPR acknowledges that safeguarding national security interests may necessitate limitations on certain personal data rights.

This provision allows organizations responsible for national security, such as intelligence agencies or law enforcement authorities, to gather, process, and employ personal data without being bound by all the requirements and rights articulated in the UK GDPR.

However, these concessions within the UK GDPR are subject to safeguards and oversight to ensure that any restrictions on personal data rights are proportionate, necessary, and compliant with the law. The UK GDPR delineates explicit provisions outlining the conditions and safeguards that must be met when applying these concessions.

In contrast, the EU GDPR adopts a more extensive and uniform approach to data protection.

While the EU GDPR permits member states to curtail personal data rights in the context of national security via legislative measures, it places a stronger emphasis on safeguarding the rights and freedoms of individuals and maintaining a consistent standard of data protection.

Penalties and fines

The EU GDPR explicitly states that certain violations are more severe than others. Less severe infringements may lead to a fine of up to €10 million or 2% of the firm’s annual revenue from the previous financial year, whichever amount is greater.

On the other hand, more serious infringements may result in a fine of up to €20 million or 4% of the firm’s annual revenue from the previous financial year, whichever amount is higher.

The same principle is applicable to the UK GDPR. Violations that are not categorized as severe may result in a fine of up to £8,700,000 or 2% of the firm’s annual revenue from the preceding financial year, whichever amount is greater.

For serious violations, organizations could face fines of up to £17,500,000 or 4% of their annual revenue from the previous financial year, whichever amount is higher.

Cooperation and collaboration

The EU GDPR institutes the European Data Protection Board (EDPB) as a pivotal component for fostering cooperation and consistency among Supervisory Authorities throughout EU member states.

The EDPB comprises representatives from each member state’s Supervisory Authority, the European Data Protection Supervisor (EDPS), and the European Commission. It serves as a platform for collaboration, coordination, and decision-making concerning the application and interpretation of the EU GDPR.

The EDPB plays a crucial role in promoting the harmonization of data protection practices across the EU. It offers mechanisms to ensure a consistent application of the GDPR and to address disparities in interpretation or practices among member states. The decisions made by the EDPB hold a binding effect, contributing to the uniform implementation of the EU GDPR across the EU.

In contrast, while the UK GDPR underscores cooperation with EU Supervisory Authorities, the UK lacks representation in the EDPB. Following the UK’s departure from the EU, the UK GDPR functions within the realm of the UK’s autonomous regulatory framework for data protection.

Nonetheless, the UK GDPR still acknowledges the significance of cooperation with EU Supervisory Authorities. It establishes mechanisms for collaboration, coordination, and the exchange of information between the UK’s Information Commissioner’s Office (ICO) and EU Supervisory Authorities. This ensures an ongoing collaboration and information sharing on data protection matters that have implications for both the UK and the EU.

How are businesses operating in the EU and the UK affected?

The disparities between the EU GDPR and the UK GDPR present substantial challenges for businesses operating in both the EU and the UK, as well as for businesses from countries outside the EU. These challenges arise from the distinct regulatory frameworks, legal requirements, and compliance obligations imposed by each regulation.

For companies that conduct operations in both the EU and the UK, sustaining consistency and alignment in data protection practices across both markets can be quite demanding. They might be required to establish distinct data protection policies, procedures, and mechanisms tailored to each jurisdiction. This can lead to increased operational complexity, administrative burdens, and costs.

Businesses originating from countries outside the EU encounter additional complexities. If they process the personal data of individuals within the EU, they must adhere to the EU GDPR’s stipulations for cross-border data transfers and the appointment of an EU representative.

Simultaneously, if they process the personal data of individuals in the UK, they are obliged to comply with the UK GDPR and appoint a representative in the UK, albeit with more flexibility concerning their location.

The challenges faced by businesses operating across the EU and the UK, as well as those from non-EU countries, encompass the necessity to manage dual compliance frameworks.

These businesses must interpret and apply distinct legal provisions, navigate varying guidance and interpretations from Supervisory Authorities, and adapt to diverse mechanisms for data transfers and representative appointments.

Why Bizky?

At Bizky, a payroll and financial solutions platform, we are committed to upholding the strictest standards for handling highly confidential information.

Our primary services encompass access to our team of experts specializing in various compliance aspects. The innovative approach ensures tailored guidance for businesses operating across diverse global regions. Don’t hesitate to request a demonstration of our solutions.