Google planning to shift UK data to the US?
The company announced on 20 February that it's making plans to move its UK data controller to the US.
The company said that uncertainty surrounding future data protection regulations following the UK’s exit from the European Union was the main reason for the change. It also plans to change global terms of service at the same time.
About this Google decision
Google states changing its terms of service will make them more understandable. At present, the data controller for all UK users is based in Ireland, and this has been the case since GDPR came into force in May 2019.
The Reuters news agency has reported that Google’s move could impact existing legal protections of all UK user data. As Google’s Irish data centre is based in the EU, so has to follow all GDPR requirements which are far more strict than existing privacy laws in the US.
The recent enactment of the Cloud Act in the US may make it easier for British law enforcement agencies and intelligence services to obtain this data, according to the exclusive news report published by Reuters on 19 February.
Google has not confirmed this news ahead of any kind of official press release, although a spokesperson did tell Reuters that UK privacy rules will be applied to any request for user data made by UK authorities.
At present the UK is locked into GDPR. However, this situation could change after 31 December 2020.
The UK’s Office for the Information Commissioner (ICO) commented that current plans are to bring the GDPR into statute books as “UK GDPR”. Although, current Brexit talks and any final deal are likely to bring some change, particularly relating to data transfers between the UK and European Union.
The ICO also confirmed that all UK users are presently covered under the UK Data Protection Act 2018 which is in line with GDPR regulations. Therefore, any organisations handling user data will need to ensure compliance.
Shannon Newberry, a Google spokeswoman, said: “We’re not changing the way our products work, or how we collect or process data.” Adding there would be no change to the ways that data is processed or to standards of privacy. However, Reuters stands by its story and says UK users will need to acknowledge Google’s new terms, alongside the change to data centre jurisdiction.
Additional Google updates
Google updated its UK user terms of service on 20 February, which was the first major change since the year 2012. The brand stated this will “make them easier for people around the world to read and understand”, adding that recent court cases in Germany and France flagged criticisms of the way the search giant obtains informed consent for data processing from existing users.
Although these new terms of service are alleged to be easier to comprehend, they are actually 1,000 words longer as they cover services such as Google Drive and Google Chrome. Google also said it will be adding a description of the ways its business operates to the Google About page. These new terms come into force on 31 March 2020, and all users will receive email notifications, in addition to app and Google homepage updates.
To discuss digital GDPR guidance and UK hosted data services, please get in touch.