The UK will still be subject to European data protection legislation even if it leaves the European Union, according to a lawyer.
The European Commission is currently discussing reforms to data protection legislation within the 28-country bloc that could have a significant impact on the way all businesses treat data such as personally identifiable information.
Proposals for a root-and-branch reform of existing data protection legislation have been in discussion since 2012 and it had been expected new laws would be implemented by 2014.
However, the Snowden revelations of 2013 have caused the discussions to drag on longer and it is thought new legislation will not be brought in until 2016 - the same year David Cameron hopes to hold an in-out referendum on the UK's continuing membership of the EU.
At a press panel held by analytics firm Teradata, Joanne Bone, a partner at lawyers Irwin Mitchell, said: "If we decide to come out of the EU, there are two things [that will happen]. The first is, as the legislation has extra-territorial jurisdiction built into it. If you monitor the behaviour or collect personal data relating to an EU citizen, you will be caught by it wherever you are.
"So if you are in the UK, even if we are out of the EU, if you are trading with Europe in any way ... [including] dropping cookies, then potentially it won't make any difference whether we are in or out. [But] I don't think there are that many businesses these days that are just UK data focused. So I suspect coming out of the EU will have some impact but not a massive impact."
The European Commission hopes to have completed its revamp of data protection laws by the end of 2015, aiming to strengthen citizens' rights over their data, introducing a right to be forgotten, simpler access for citizens to their own data, and the requirement for explicit consent for companies to process someone's data.
Some countries including the UK have raised concerns over the new legislation, with former justice minister Lord McNally claiming SMBs will not benefit.
It means the proposals could be watered down, but three partial-agreements have been reached in the Council of the EU on key aspects of the General Data Protection Regulation.
These cover rules governing how companies process personal data, rules on how the public sector treats personal data and a measure to make it easier for firms to do business in the EU.
-
Third time lucky? Microsoft finally begins roll-out of controversial Recall featureNews The Windows Recall feature has been plagued by setbacks and backlash from security professionals
-
The UK government wants quantum technology out of the lab and in the hands of enterprisesNews The UK government has unveiled plans to invest £121 million in quantum computing projects in an effort to drive real-world applications and adoption rates.
-
UK businesses patchy at complying with data privacy rulesNews Companies need clear and well-defined data privacy strategies
-
Data privacy professionals are severely underfunded – and it’s only going to get worseNews European data privacy professionals say they're short of cash, short of skilled staff, and stressed
-
Four years on, how's UK GDPR holding up?News While some SMBs are struggling, most have stepped up to the mark in terms of data governance policies
-
Multicloud data protection and recoverywhitepaper Data is the lifeblood of every modern business, but what happens when your data is gone?
-
Intelligent data security and managementwhitepaper What will you do when ransomware hits you?
-
How to extend zero trust to your cloud workloadsWhitepaper Implement zero trust-based security across your entire ecosystem
-
The threat prevention buyer's guideWhitepaper Find the best advanced and file-based threat protection solution for you
-
Why The Matrix offers valuable lessons on data sovereignty for channel partnersIndustry Insight Two decades on, there's much that the Matrix series can teach channel partners about data sovereignty
