Yes, that's also my understanding, but EU GDPR refers to data being inside and outside the territory of the EU.

So, transferring your data between the EU and UK will mean you are (now) crossing a data border. That's a change.

I understand that GDPR will immediately split into EU GDPR, and UK GDPR.

Yeah, but have UK privacy laws been updated to reflect fact the UK is no longer part of the EU?

Something I've seen in lots of UK law derived from EU directives is that it applies limits to behaviour specifically happening in the EU. So UK privacy law might provide a whole load of protections to EU citizens, but not specifically to UK citizens, because EU citizens would be a superset including UK citizen. Except, as of 1st Jan 2021, that won't be true any more.

I understand that those laws have been updated: that EU law is initially being adopted with appropriate changes, i.e. it won't reference the EU any more and will reference the UK instead (and isn't defined around citizenship anyway)

I have a similar understanding, what will be interesting is how the UK will enforce its rules. Facebook has its HQ in Ireland, which notable not in the UK. This also applies to most other US companies.

Kinda makes me suspect that some companies will just ignore UK data protection law on the basis the UK can't do squat to enforce it.

Yes, same. Also, Facebook has Nick Clegg on staff.

That suggests they've spent 2 years explicitly lobbying for whatever UK law changes they want, and will probably quickly get them.

They must have had some work done on figuring out which legislation needs updates like this?

Yes. And that also means protections remain the same regardless of this move from Ireland to US jurisdiction.

Yes, for now, although it would surprise me if changes haven't already been negotiated with the UK government: Deputy Prime Minister Nick Clegg has been on Facebook's staff since 2018.

Even without that, it doesn't make sense for Facebook companies to store the UK data in the EU/Ireland, where it would presumably then have to comply with both EU GDPR and UK GDPR.

That’s former Deputy Prime Minister, for the record. Considering his subsequent performance at the polls, a lot of people would further add the prefix “disgraced”...

I think that's correct. Facebook even said:

> There will be no change to the privacy controls or the services Facebook offers to people in the UK

> Facebook’s UK users will remain subject to UK privacy law, which for now tracks the European Union’s General Data Protection Regulation (GDPR).

Presumably this move in preparation for when that stops being the case.

EU directives such as GDPR come into power by being localised and enacted, ie made into UK law. The data protection act 2018 will cover us up until it’s reversed, which is what some of us fear.

FYI, that's not quite correct. The EU makes laws in several ways. A directive is, as you said, a measure that individual member states then incorporate into their own national law to give it legal weight. But the GDPR is, as its name suggests, a regulation, which means it carries legal weight immediately and in its own right across the entire EU.

The UK's position is strange because of Brexit, but it seems the practical position of all recent governments has been that existing EU laws should be transposed into UK national laws where necessary and with the required changes to make sense, until such time as our national authorities might decide to deviate from them. Primary legislation has already been made to that effect. The big question is what "that effect" actually is, given the huge volume of legislation affected and the potential ambiguity in what changes are required for any given law of EU origin to continue to make sense in a post-Brexit UK.

No need to speculate.

https://www.legislation.gov.uk/uksi/2019/419/made

I was thinking of this, a year earlier. https://www.legislation.gov.uk/ukpga/2018/12/part/1/enacted

The R in GDPR is not for directive. As a regulation, it applies directly.