Hey everyone welcome back to Tech Talk I'm Juliet Beauchamp I'm here with Ken
Mingis executive editor at computer world and Matt Egan editorial director
at here at IDG and we are talking all things brexit what that means for data
protection laws what's gonna happen with gdpr once the UK if and when the UK
leaves the EU so stick around so Matt thank you so much for coming all the way
our resident UK resident thank you so much for having me
so it's I mean the date is fast approaching for the hard deadline to
leave the EU and that's gonna mean a lot of things for UK residents but something
that's really gonna be interesting for UK organisations is how like us here at
IDG is how that's going to affect data protection and users data and how the
free flow of data will work so can you tell me a little bit about how what the
current law in place is in the UK and the EU sure so the gdpr which has had a
pretty significant impact on both the way the businesses use data and
individuals data is used it's the result of an EU directive which basically says
that as a user you have the right to control how your data is used to ask
what data is held by companies to ask for its but deleted to understand how
the company is using that data it was a European directive which the UK
adopted into law in 2018 so that law will stay in place it's kind of
important to understand that that Europe doesn't really make laws it makes
directives that Member States bring into place so the basic principles which I
think we all would agree a pretty good will stay in place and actually I
believe this year in the u.s. something similar is coming into law so that's
good the challenge for the for the UK which is allowed so many other
challenges for the UK with this whole leaving the EU thing is nobody actually
knows what it means in terms of the UK's status as a country within the GDP are
so as it stands currently you can share information between countries with the
users permission if they're within the you because we are all considered equal
in terms of law but when the UK leaves particularly if the UK leaves with no
deal then presumably we become a kind of unknown quantity what they call a third
party country which will severely restrict how a business like ours
actually can share data across territories within the EU is there any
timeline yet Matt for when will know whether there's gonna be a hard brexit a
soft brexit or any you know anything in between well certainly when we started
this recording Ken they may have happened over in the last
few minutes or something of a move I mean as it stands
Juliet's point the deadline is is the end of March essentially and the way the
politics are playing out right now is it's very much been seen as we will
leave at the end of March there's an element of brinksmanship around that
without going into too much detail and the honest truth is it's this is one of
those rare occasions in history and politics where nobody really knows it is
conceivable that and the EU hasn't said that if the UK asks this could be
extended and it could go further because although data is extremely important
it's probably not as important as a supply of medicines and foods and so
forth which are also kind of being considered at the minute so it's
conceivable that we will leave with no deal at the end of March in which case
who knows what will happen then it becomes kind of an unknown and we'll see
how it goes it's also conceivable the whole thing was delayed and it's
possible that these things will be ironed out in the intervening time but
with the current political deadlock that seems unlikely
sure so with the potential of leaving with a deal something like data
protection laws it's certainly something that could be negotiated into it but
like you were saying if there is a hard brexit a no deal brexit and the UK
leaves there's it's sort of this third party nation and there wouldn't be that
immediate ability to share data with other EU countries what would the
process for becoming recognized by the EU but being able to share data with the
EU what would that process look like well again it's unprecedented so nobody
knows but but the the basic principle is seen to be that
you know all these things in the NGO Shaboom so within so for instance if we
think of the free movement of people physically there is this thing called
the Schengen Agreement which means non EU countries have a deal with EU
countries Switzerland is a classic example of this that allows people to
have the freedom of movement there currently for instance the UK has with
France and Spain and Ireland that you don't need to go through checks at a
border points get through so there is a principle that says a similar agreement
could be reached with data and it is definitely the case that the EU has you
know is seeking these kind of relationships anyway right so there is
most businesses like ours within the US have already adopted GDP our style
policies because we have audience in in the EU anyway so you might as well go to
that standard and the standard makes sense if you're someone who respects
your audience and you respect your customers and that does mean that there
is a willingness and an understanding with you within the EU to make
exceptions and have exceptional countries who are considered no you know
I'm curious do you have any sense I mean gdpr has only been on the books I think
since last May and I've seen you know it sounds like there's been sort of a slow
rollout in terms of companies being fined I know that there was a I think a
French agency had find Google something like 50 million euros for some issues
last month and some smaller fines do you get the sense that while 2018 was the
year of basically educating companies and consumers and people about data
protection that 2019 may be the year we're going to start to see some larger
fines assuming that there are breaches and issues yeah I mean there's no
speculation in this but I think that is the case I mean there was definitely if
not explicit language there was definitely the idea that companies would
be given a chance to get their house in order in fact part of the language is
about being seen to have a policy and communicating it within your business
and we were given guidance that you know there had to be an appointed chief data
officer and that person had to communicate certain policies around the
business so not that you get a free pass but if you happen to make a mistake but
you've done the prep work and it was all perceived to have been done
in good faith then it was explicitly stated that you wouldn't be pursued by
the authorities there's also the question of how how impossible this law
is right because you get to the stage where a company like Google kind I mean
Google kind of has to choose whether or not it pays tax in certain territories
and it kind of gets to choose whether or not I mean you know it pays a fine to a
specific country because it can up stick some move to a different place and you
know there is some precedent for this so at the same time if you're a smaller
business you might not even get noticed frankly it would require someone's
complain about you ultimately so I think there has been a general tenor around
this stuff which is the laws all make sense it's good principle nobody really
know anyway really wants to be in a world where data is treated badly and
was kind of a wild-west situation so there is an element of people given
chance to get the house in order but to your direct point I think probably 2019
you're less likely to get away with a breach than you might do in 2008 yeah
yeah make sense yeah that does make sense so what so for at this point in
time if if if a company is online if their tech company they're an
international company at this point it's not like there's any company that can
say well we are based in the UK so we're I mean there may be some North Korean
companies they're probably not gonna be too worried about GDP nor so since there
is pretty much anyone can access anything online
what does um how would a No Deal brexit affect the EU as opposed to the UK so we
know the UK would have to apply from the other side that's a really good question
actually because the UK law was written essentially to mirror the GDP our so I
don't know if then and I suppose it's conceivable and therefore possible that
the EU becomes a third party to the UK which again is a knowns interests so I
suppose the short answer surveys I don't know the good reason for that is I don't
think anybody knows and one of the things that has been
talked about is the you know this idea of an Odile brexit leading to an
immediate wasteland with marauding gangs swirling around the country is is
unlikely to be true because the principle that we adopted is what was
law yesterday will remain in principle law today but it will need to be
renegotiated so in this instance that is and that I suppose there is an element
of leverage there because the UK is a very valuable market for most EU
operatives so nobody wants to go backwards in this day well many people
in this conversation wants to go backwards but most most businesses wants
to be able to do business as easily as possible and so I guess in the same way
as a business like ours which is truly international adopted GDP our globally
because why wouldn't we I think the EU member-states would want
to do business with the UK and so would probably accept some level of pretty
cuoco around that I'm curious you know stepping back from just the GDP our
whether or not the uncertainty around brexit is having any kind of chilling
effect on business in particular you know tech business
I mean I've certainly seen things we were talking about this yesterday about
the Honda plant that's being closed and I saw some story that said that if
there's a hard brexit that travelers from the UK who are in Europe might
suffer roaming fees when they're using their phones I mean it's almost like
being this weird sort of different class of citizen have you gotten any sense you
know whether companies and I guess since you know we're looking at tech companies
whether they're you know nervously eyeing this or whether they're just
gonna wait it out and hope that everything sort of gets muddled through
yeah so I think I mean and and to make at one point there it is explicitly been
a different class of citizen because right now anybody in the UK any new
cases and as European citizens right and that will go away so it does have a
personal impact on that level I think there are two levels of approach to this
there's a lot of uncertainty full-stop and those definitely impact on the
economy if you deal with physical products so car manufacturers aren't
classic exactly right then it becomes even those who are sort of remaining
committed to the UK are talking about pause in production because they
literally done know how they're gonna get products in
and out and in a just-in-time world it's very difficult to plan production if you
don't know how long it's gonna take you to get car parts through hots which is
literally what we're talking about at this stage if you're making cars only
for the UK all of a sudden then you're gonna make far fewer cars from so that
that has definitely had an impact however within the part of tech which is
virtual it's more just a level of uncertainty so an example would be like
nobody really knows how v80 is gonna work right across right but we can all
mitigate risk for that and say it'll probably work broad to speak in the same
way the UK is still a great place to do business so maybe we'll wait and see
would be a good way of looking at that I think one of the other challenges that
people have is around personnel so a big a big play for the UK's is the languages
spoken in the US which is quite and of important and geographically actually
UK's nicely placed between the US and Asia and therefore lots of companies
have big workforces in London there are multi national workforces and mrs.
London specific problem all of it so in anyway and again we've got some
experience of that in our own office where we have people from Spain and
France and Poland none of whom really know what the long-term future is so
that is another source of anxiety and therefore insecurity for businesses and
tech businesses are big employers of those kind of educated transient people
so it's a much it's a much lower level of anxiety currently and very few tech
companies are making the right now active decision to exit the UK in the
way that some of the manufacturers are but I think it's definitely there but
it's kind of a wait-and-see so at least it's not hellscape on March 30th or 31st
brexit expert expert oh that was good I think it's like you said how when once
the UK leaves there's gonna be that sort of sense that the what was a
law yesterday is still gonna be the law today that's kind of interesting just in
how that's going to be enforced in particular with these data protection
lies I mean if I'm on a website I find this a lot if I'm on a dot co dot uk'
website if I'm looking up like love island information and they I always get
a sort of that privacy notification and I just wonder small things like that if
is that gonna change I don't know really and that's that in and of itself has
been quite an interesting thing because that is really an interpretation of the
GD P R and then became widely adopted but it's not you don't specifically have
to put that message that's just been seen as a way of gaining consent which
is a very important part of the GD P R it's always interesting to me to be in
the u.s. because it because it's not there and that's kind of strange right
you know and because I'm just used to every single website you go into it been
there I would say it's unlikely people would remove it because it's a good way
of mitigating risk for the business and the user behavior has become such and we
can measure this that people basically just click yeah I do I know I don't
quickly breathing I mean if if people were sufficiently concerned about the
use of their data they wouldn't be using social media for stuff so so you know
that that level of consent and we and again just speaking for our own
publications you can see they're a tiny percentage of people actually go in and
change the the levels of consent you can give which is which is the opportunity
that you can give so I think it would probably stay because again why would
you take the additional risk of to our previous conversation being somehow
targeted by the European Union when it's a relatively trivial thing now that it's
in place to have their I do wonder to this is gonna prompt the u.s. finally to
get on board with some of the privacy regulations that have been debated here
in Congress I don't know how much you track that but I think California is
moving forward with its own sort of statewide regulations which would then
spill over to probably the rest of the country I'm not sure we're gonna get
anything out of Congress this year that doesn't excuse me that doesn't seem to
be a lot of interest in regulation these days I DC but I do think that because
the the Europeans have sort of planted the flag
that you know people are more aware they almost have to be yeah about data
protection privacy and how you know both valuable and fragile that data is in
terms of keeping it protected so I think it's a good thing and that's that's what
led me to that question earlier about whether we're gonna see bigger fines
issue I think that's gonna be the big way attention get people's attention and
of all the states in the Union California is the one that from a media
and tech perspective really matters right and from an economic perspective
you know right so it's 150 it's the fifth biggest economy in the world i
right yeah so so California making that decision essentially makes that decision
for almost every data holding company in the US so you know in effect kind of
thing whether it's regulated elsewhere or not I guess you might find that
there's this kind of pockets of places where they do things differently because
they can in the same way that we see that with taxation within the US you
know for them I think you know certainly if I think about our business like once
California makes a regulation we're gonna adhere to that California goes so
goes the u.s. yeah absolutely so I was also wondering can I'm just
seeing that you have this art or hold up that French data protection watchdog
find Google and I wonder if how those sort of I mean that's a wonderful
resource that all of the EU really benefits by this French watchdog groups
organizations work and will I wonder if this is more interested hypothetical I
wonder if the UK will still sort of enjoy that opportunity that you know
these other countries have there have I mean found that the UK doesn't have a
cybersecurity watchdog er nobody it does like as we've cyber security as well for
now it does you know that there are how can I say this in a balanced way there
there are pluses and minuses to being able to make your own decisions have
been part of the bigger gang right and that's that's another example that
doriel that is a good example of how what happens in one member state is then
let's wear the member-states you know and that's not always good and certainly
there are people within the UK who would say we don't want to you know have the
way things are approached dictated to by a group an unwieldy group of lots of
different countries but there's definitely a certain loss of strength in
numbers I guess you know it's very interesting thank you and I think that
that covers that I guess we're gonna wait and find out how much we muddle
through all of this we'll have you back in a few months if you can you can come
back great thank you guys so much it was really
interesting and I mean the great thing is that we're not gonna have to wait
that long to find out how this is all right unless the UK pushes back I
predicted the model yeah yeah that's true so thank you so much for watching
this episode of tech talk if you liked this video be sure to give it a thumbs
up subscribe to our Channel and be on the lookout for new tech talks coming
soon thanks