I don't think they're going to have to move, just remain compliant with the GDPR rules. UK businesses still have a lot of customers in the EU, and will have to comply with the GDPR to continue their businesses, so I very much doubt much is going to change.
If there is sufficient deviation from GDPR (who knows what will happen from this speculative article alone), the UK will probably lose its adequacy to transfer personal data, which will materially impact how international organisations can transfer data. In fact the recent UK-EU adequacy decision explicitly states this [0]:
'For the first time, the adequacy decisions include a so-called ‘sunset clause', which strictly limits their duration. This means that the decisions will automatically expire four years after their entry into force. After that period, the adequacy findings might be renewed, however, only if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place. Should the Commission decide to renew the adequacy finding, the adoption process would start again.'.
The impact of a loss of adequacy will be significant on UK service providers, as it will become significantly easier from a regulatory perspective to just host within the EU for both UK and EU customers than to deal with the hassle of using UK datacenters.
Comments
I don't think they're going to have to move, just remain compliant with the GDPR rules. UK businesses still have a lot of customers in the EU, and will have to comply with the GDPR to continue their businesses, so I very much doubt much is going to change.
If there is sufficient deviation from GDPR (who knows what will happen from this speculative article alone), the UK will probably lose its adequacy to transfer personal data, which will materially impact how international organisations can transfer data. In fact the recent UK-EU adequacy decision explicitly states this [0]:
'For the first time, the adequacy decisions include a so-called ‘sunset clause', which strictly limits their duration. This means that the decisions will automatically expire four years after their entry into force. After that period, the adequacy findings might be renewed, however, only if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place. Should the Commission decide to renew the adequacy finding, the adoption process would start again.'.
The impact of a loss of adequacy will be significant on UK service providers, as it will become significantly easier from a regulatory perspective to just host within the EU for both UK and EU customers than to deal with the hassle of using UK datacenters.
[0] - https://ec.europa.eu/commission/presscorner/detail/en/ip_21_...