Why Brexit will be Business as Usual for Cyber Security & Data Protection in the UK

So it actually happened, they have gone and done it, its shocked the world, the UK populous have voted to leave the European Union today. Now what? Well we'll have to just get on with it and starting thinking how Brexit will impact Cyber Security and Data Protection in the UK from here on in. 

I didn't post a word on Brexit despite being asked numerous times during the "debating" season, or as we in the security industry call it, FUD!.  But now its done and dusted, here are my thoughts, which as always on this blog, are completely my own.

Cyber Security Defence
The UK is a significant player in the international cyber threat intelligence community, although a highly secretive business, the “snooping” documents leaked by Edward Snowden demonstrated how closely GCHQ works with their American counterpart agencies. When it comes to the business of protecting the UK’s critical national infrastructure, economy and businesses from cyber attacks, NATO membership trumps the EU membership every time. So I don’t believe UK citizens should be too concerned that Brexit will significantly weaken the UK’s cyber defence posture. I also don’t see that UK security agencies and services ties being cut with their European counterparts any time soon, given the common terrorist, criminal gangs, and cyber threats European countries share.

Privacy and Data Protection
Privacy is a fundamental right for all European Union citizens, and to address this right in the digital space, the EU have devised the General Data Protection Regulation (GDPR). The GDPR is a top to tails overhaul of Europe's current Data Protection Directive (law), upon which EU member states data protection laws is based, including the UK’s Data Protection (Act) law. Europe’s existing data protection legalisation is well past its sell by date, it was drafted without any knowing or consideration of social networking, borderless cloud services, and colossal personal data collection and mining. Yet despite desperate need for digital privacy protection legalisation in Europe, the GDPR has been held up by Brussels’ bureaucratic red tape for far too many years, and it has only recently made it an agreed final draft, which is due to come into European Union law in May 2018.

The GDPR applies not just each EU member state, but any business or organisation from countries outside the European Union which stores and/or process EU citizen’s data. So from the UK perspective, despite the uncertainty caused by Brexit, my advice is for UK businesses to assume the GDPR is still going to apply, and to continue preparations to be compliant by May 2018.

Why UK will still need to comply with GDPR
I believe it is highly likely that the UK government (executive) will adopt the GDPR into UK law despite Brexit, or at the very least the vast majority of the GDPR requirements. The EU is likely to insist on the UK replicating the GDPR in law as part of the trade negotiations. Given many businesses in the UK will store and/or process EU citizen data, they still have to comply with GDPR regardless of Brexit or even client contract clauses. Finally it would be extremely emotive and controversial if UK companies were to treat and regard UK citizen privacy and personal data at a lesser degree to that of ‘foreign’ EU citizens. So I do fully expect it to be business as usual in UK on the data protection front despite Brexit.