Google will move accounts held by British users out of the jurisdiction of the European Union and under the control of United States authorities in response to the UK's decision to exit the EU.
According to Reuters, which quotes three sources “familiar with its plans,” the search giant is making the move because it's unclear whether Britain will continue operating under the General Data Protection Regulation (GDPR) once it has left the EU.
Under GDPR, companies must only collect data that is relevant, should be willing and able to explain what data has been collected and the reasons for it, have adequate security practices in place to protect that data, and not retain the data for longer than is necessary.
Failure to comply with GDPR results in the company being subject to a fine that could total four percent of a company’s annual revenue.
If Google had kept British user data in Ireland, where the company has its European headquarters, it would have been more difficult for law enforcement to access it if in future the UK decided to move away from GDPR. Google apparently could have had British accounts made responsible to a British subsidiary, but decided not to.
The UK government could change the law to lower or increase data protections, but there is currently no indication that it will do so.
Reuters reports that the US has the “weakest privacy protections of any major economy.”
Recommended by Our Editors
Speaking to Reuters, Google’s former lead for global privacy technology Lee Kissner said: “There’s a bunch of noise about the U.K.
government possibly trading away enough data protection to lose adequacy under GDPR, at which point having them in Google Ireland’s scope sounds super-messy.
Never discount the desire of tech companies not to be caught in between two different governments.”
Users in the UK will have to acknowledge new terms of service from Google that would inform them of the jurisdiction change, although whether they will actually be read is debatable.
