No-deal Brexit will Paralyze Data Initiatives for Multi-nationals

With Theresa May’s EU-approved Brexit deal overwhelmingly rejected by the UK parliament, the prospect of a “no-deal Brexit”, with all of its uncertainty, is becoming a realistic potential scenario.

With this scenario as a backdrop for some hearty British pessimism, it’s all too easy to find predictions of dystopia – from food shortages to unprecedented social upheaval. But, hidden away in the background, came a sobering warning from the Direct Marketing Association (DMA), which pointed out that pulling out of all EU bodies, regulations, and frameworks as part of a no-deal scenario, could bring data processing across borders screaming to a halt.

Losing GDPR compliance has potential disastrous consequences for multi-national organizations where the UK is a vital region

The risk is that severing all ties with Europe will also see the UK effectively withdraw from Europe’s data protection body, also known as the General Data Protection Regulation (GDPR). Our previous research digging into GDPR compliance reveals just how seriously enterprises in the UK and Europe are taking it (see Exhibit 1). Worldwide, at least ¾ of organizations already know how GDPR would affect their organization—but any preparations they may have made were unlikely to have anticipated the impact of a no-deal Brexit.

Exhibit 1: How well do executives around the world understand GDPR?

Source: HfS Research, 2018; N-300 business executives

Exiting GDPR could stop data flow—how would you respond?

If pulling out of GDPR as part of a no-deal scenario becomes a reality, it could become impossible for enterprises to transfer data from mainland Europe to the UK or to process data that has been gathered on either side of the channel, effectively grounding major multinational data projects. Although advice from the government is that GDPR will be part of the EU Withdrawal Act, there is still a tremendous amount of uncertainty, particularly about transferring data to and from the EU.

Let’s put this into perspective with a couple of examples. Imagine a multinational enterprise with its EMEA head office stationed in London. At the head office sits the bulk of the data processing wing of the business spread across marketing, analytics, and sales. The fuel for these departments, the data, is captured from the various business units across Europe—retail outlets, partners, regional HQs, and so on. But with a no-deal, no-GDPR arrangement, all of that fuel stops. The data cannot be shipped back to the London head office for processing because it would breach Europe’s regulations, so it just sits.

One solution is the UK government tries to cling to GDPR compliance

Of course, there are solutions to this. Let’s assume no-deal Brexit becomes a reality. The UK could, in theory, try to maintain its GDPR accreditation, or it could reapply. If it’s the latter, there currently is no real way to estimate the length of time it could take to process the application. At the moment, the EU only has 12 “adequacy deals” in which non-EU countries have been able to provide evidence that they comply with EU regulations. The most positive angle is that the UK can slipstream its application to remain compliant behind its existing alignment to GDPR, but the reality is that the transfer of data may drop lower on the negotiation priorities list if the horror stories of massive supply chain disruption that could impact  food and medical shortages and social discord bear out.

The other could turn the channel into an innovation gulf as enterprises split data processing between shores

The other solution is for these enterprises to split data processing activities either side of the English channel. We may indeed see organizational structures that split the UK out as a separate territory to Europe—in some cases we are already seeing this. But, here’s the problem. At HFS, we hear about the ambitious projects in which enterprises are planning to invest over the next few years, and many of them involve capturing and processing vast amounts of data. From AI to smart analytics to a public cloud, it’s all about data.

The level of uncertainty we currently find ourselves in could see the level of investment in this space come crashing down or it could manifest in a disproportionate level of investment in digital technologies servicing Europe or the UK. After all, most enterprises won’t double down on the risk of POCs in two geographic areas. The more prudent among them will look for the economic environment that more closely resembles laboratory conditions: strong and stable. At the moment, that rules out the UK and to some extent the US, so Europe becomes the enterprise innovation hub for many international organizations that rely on Pan-European activities..

Bottom Line: Bailing on GDPR could create a data drought in the UK, it’s time to start preparing for no-deal

The modern enterprise relies on data. Whether that’s to fuel marketing activities or drive business insights, and with so much uncertainty on the table, a no-deal Brexit could lead to a significant data drought. In reality, enterprises can do relatively little to influence the direction of Brexit at this late stage.

However, what they can do is make sure POCs and existing data-driven initiatives are, to any extent possible, protected from potential disruption. At least until we have a clearer view of the scale of the impact. They can do this by working to understand their international data flows, locating potential bottlenecks, and mitigating the effect by quarantining processes until the chaos is over and ensuring that services reliant on the data can function adequately in its potential absence. Sadly, until we know exactly how Brexit plays out, there is not too much else enterprises can do beyond ensure they know exactly how they could be affected an have potential contingency plans in place.