Google moved the privacy protections of its UK users to its US entity -- this is a change that affects you

With Brexit official as of Jan. 31, the UK and the EU now have just 10 months to hammer out the policy details of their separation. In the meantime, rules --including those applicable to data privacy-- will continue to apply as normal. However, Google isn't waiting for the end of the transition period to updateits terms and conditionsas they relate to privacy;the tech giant just announcedthat, since the United Kingdom is leaving the EU, as of March 31, 2020, Google LLC (Google's US entity) will become the service provider and the data controller responsible for its UK users' accounts -- in lieu of Google's European entity.

If you think that this is just a detail for lawyers and data protection specialists, think again! This decision may not result in an immediate, material change to UK users' privacy, but it will soon. Making Google LLC the data controller for UK personal data means that:

Companies doing business with Google in the EU and in the UK must analyze these implications carefully. Because of its decision to effectively move UK users away from the protection of European data protection authorities, risk and privacy professionals must reassess their third-party risk plans and update their mitigation measures if necessary. Companies that do not partner with Google directly must also consider how this decision plays out in the broader discussion about EU-UK data transfers. Organizations must:

[i]Until the transition period is complete, GDPR will still apply in the UK. In addition, the UK government announced plans to adopt the "UK GDPR." As the name suggests, this set of rules will be closely aligned to the exiting EU GDPR and will accompany the existing UK's Data Protection Act 2018. Most likely, the ICO and UK courts alone will oversee the enforcement of these rules.

This post was written by Senior Analyst Enza Iannopollo, and it originally appearedhere.