Google and GDPR / Data Protection


Google has announced that it is changing its term and conditions in particular moving its UK data from Ireland to the US.

This has made the national media and has triggered a few emails to the Salford CVS offices. Hence this blog....

So why are Google doing this? 

Well its essentially a business decision and it's linked to Brexit so expect to see more discussion around this in the next few months. There are a lot of things we don't know about Brexit as we head towards the end of the transition period on 31 December 2020. At present GDPR and the related EU legislation continues to apply as until 31 December as we are part of the EU. After that date essentially the existing standards of Data Protection are not going away as it is written into UK Law as part of the Data Protection Act 2018 and at present there is no proposed changes in legislation. Based on this we know the following:

  1. How we share data with non-EU countries (including the US isn't changing)
  2. Companies will not have to have a EU base to deal with UK customers (as we are not part of the EU anymore)
  3. We (the ICO) will lose some weight as a regulator (one nation v the whole of the EU)
  4. The UK potentially become a third nation in EU data protection terms (the same as many other countries) but that is not 100% known until any trade deals are confirmed. So whilst how the UK shares data with EU remains unchanged the requirements for EU to UK data sharing isnt set in stone yet.

As a business based in the US google obviously prefers to deal with legal certainties (how the UK can share with US) and ultimately its cheaper for them to host data in the US due to having a number of data servers held there! So expect other companies to make simialr moves over the next few months.

So is it lawful?

From a data protection legislation perspective, based on current UK legislation transfering data to the US actually isn’t that complicated. Moving data to the US is called an international data transfer. The ICO have various guidance available on this including the four mechanism that allows it to happen. The two most relevant to us and this situation are Privacy Shield and standard contract clauses.

  • Privacy shield  - essentially guarantees a level of security and rights for individuals.  Most companies (including google) promote the fact they have it openly. But you can double check and look it up yourself too if in doubt
  • Standard Contract Clauses - again most companies doing this type of data storage promote this fact. As your data processor you need to have a suitable agreement in place with them - this will be usual a document called a data processing agreement or it may form part of a contract or agreement of terms and services. No matter what its called you need to have a signed copy! In googles case there is available to sign and download online.

Last but certainly not least you need to make sure you have told people that their data is being held in the US. Make sure that you update all your privacy notices to include this, Being open and transparent with people about how you handle there data is a key principle of data protection so it could easily be argued that this is the most important step!

Is it ethical?

Much of the media debate has actually been focused on how Data in the US is more easily accessed by government agencies (both the US and UK government). This is lawful but is it ethical for organisations to knowingly but their data in the US? Its tricky and ultimately depend on you, your organisation and the types of data / individuals you work with. 

What does this mean for charities?

The first priority will be checking that your data flows and making sure you have appropriate agreements in place and that your privacy notice is up to date. Its as simple as that!

After that it is a case of watch this space! 

This is going to be a moveable feast of the next few months as the UK thrashes out its stance with both the EU and the US as part of broader trade agreements and comapnies make their own decisions and opinions. It will be very political as the UK has a mixed reputation in terms of privacy in part due to our approach to mass surveillance (CCTV etc). This doesn't affect our relationship with the US but it may potentially limit our data protection adequacy status with the EU. But then again we are a key trade and intelligence agency for the EU. You may wish to add this aspect to your organisation risk register as I can see a number of boards having to have a balanced discussion by Janurary 2021 once we know what is happening.

For many organisations it will be a debate between the cost savings offer by many of the "tech giants" versus the data ethics for their organisation and services. I can also see a number of companies offering their data storage services location as a key selling point (e.g EU or Canada) similar to what happened two years ago as GDPR first came in. Organisations will be able to lawfully hold their data in the US but longer term it is a question of if they want to especially if they work with particularly vulnerable groups such as migration or justice.

Salford CVS
Marie Wilson


Data protection and all measures of the file are approved for the persons. The site is revered for the protection of the data and best essay writers for the options for humans. Elevation of the data protection is dumped for the devices or the citizens.

I am extremely delighted in for this web journal. Its a useful subject. It help me all that much to take care of a few issues. Its chance are so awesome and working style so rapid. albañiles zaragoza

Data protection and all measures of the file are approved for the persons. The site is revered for the protection of the data and  online academic writing services uk

In recent years, we prefer to use online media to watch television, as in many other areas, especially thanks to the accelerating and evolving internet infrastructures. Thanks to the ease with which computers and portable devices bring to our lives, we can easily follow the series, news program or documentary we want wherever we are. However, the number of websites that provide visitors with user-focused, quality live tv is relatively small compared to malicious sites that trick users.

Aiming to provide a decent and quality environment for its visitors in that sense, he is easily separated from his peers. The site allows you to access live coverage of many other Turkish television channels such as Kanal D, ATV and TV8, and also shares information such as detailed streaming lists and ratings reports with its users. By selecting the channel or type of program you want from the lists of programs divided into categories such as sports, documentary and news. you can easily watch it through.

The site, which hosts most of the national and private channels and aims to broadcast without interruption, also provides various advantages to its members through its membership system. Enjoy live tv in an environment free from annoying, user-friendly applications. you can visit.

contact us

sign up

Join us

Get In Touch

Salford CVS & Volunteer Centre
Registered address 
The Old Town Hall 
5 Irwell Place 
Salford, M30 0FN

Tel: 0161 787 7795 


Salford CVS is the city-wide infrastructure organisation for the voluntary, community and social enterprise sector; providing specialist information, advice, development support and opportunities for influence and collaboration.

Latest Blogs

Exciting new Irlam Endowed Primary School has finished there new outdoor all weather pitch!

With many volunteers unable to be involved with their regular volunteering activities during this

I am passionate about mental health!