Google Users In UK Could Lose EU Privacy Protections

Google is set to move British user accounts and data from the EU to the US, meaning they could lose the protection of the EU's General Data Protection Regulation (GDPR).

The move, prompted by the UK's exit from the EU, means that British users will no longer fall under the jurisdiction of Ireland - Google's European headquarters - which remains in the EU. As a result, depending on future UK legislation, the personal information of the UK's tens of millions of Google users could lose the strong protections of the GDPR, instead falling under the US's far looser rules.

The company has apparently ruled out using a British subsidiary to handle UK customers instead.

Google says it plans to ask British users to acknowledge the new terms and says that, for now at least, nothing will change.

"Like many companies, we have to prepare for Brexit," it says in a statement. Nothing about our services or our approach to privacy will change, including how we collect or process data, and how we respond to law enforcement demands for users' information. The protections of the UK GDPR will still apply to these users."

But the move could make it easier in future for British law enforcement to access personal data - and to carry out mass surveillance, says Jim Killock, executive director of campaign group the Open Rights Group.

"We have no reason to trust a Donald Trump government with information about UK citizens. The possibilities for abuse are enormous, from US immigration programmes through to attempts to politically and racially profile people for alleged extremist links," he says.

"Data protection rights will also become more fragile, and are likely to be attacked in trade agreements pushing 'data flows'."

Of course, it's not entirely within Google's remit to decide how it is regulated. It's possible that the UK could decide to carry on implementing GDPR or similar rules after Brexit comes into effect at the end of this year.

However, in a written statement to the House of Commons earlier this month, prime minister Boris Johnson said the government planned to 'develop separate and independent policies' - adding to reporters that "We will restore full sovereign controls over our borders, immigration, competition, subsidy rules, procurement, data protection."

"Google's decision should worry everyone who think tech companies are too powerful and know too much about us," says Killock.

"The UK must commit to European data protection standards, or we are likely to see our rights being swiftly undermined by 'anything goes' US privacy practices."

Updated to include statement from Google.