We need your support to keep TheyWorkForYou running and make sure people across the UK can continue to hold their elected representatives to account.Donate to our crowdfunder
I understand that the Minister is saying that my supposition is correct that after a no-deal Brexit a UK data controller doing business in the EEA will have to have a representative in the EEA as well as in the UK because this will be a reciprocal obligation—the Minister is nodding, so he agrees. The key point is that that is a significant burden on businesses. There is no way of getting away from it. That is a new and significant burden on UK businesses as a result of the regime put in place by this instrument, so why is it not flagged up in the Explanatory Memorandum to this order? Indeed, to take up the point made by my noble friend Lord Rooker, why did our Select Committees not point this out in their analysis of this instrument? My reading is that this is going to be a burden on a very substantial proportion of businesses which conduct business that involves data. Therefore almost all of them that do business on the continent will be required to have a representative on the continent for GDPR purposes which they do not have to do now and will not have to do if there is a deal because we would have continuity of the existing GDPR arrangements.