Is a company still required to pay fines if the applicability of a law changes during the investigation?
<p>This question was inspired by <a href="https://security.stackexchange.com/questions/215025/ex-contractor-published-company-source-code-and-secrets-online">this question on Security.SE</a>, regarding a data breach in a UK-based company.</p>

<p>In short, the data of a UK-based company was leaked by an US-based contractor. Since the UK is still part of the European Union, it is therefore still affected by the GDPR, and may be legally responsible to report a data breach.</p>

<p>One person commented, that said company would only be affected by the GDPR, until the UK would leave the European Union.</p>

<hr>

<p>Inspired by this, I would like to present a hypothetical situation, in which a UK-based company had a data breach while still affected by the GDPR, but chose not to report it, because that situation would change soon.</p>

<p>However, the relevant offices were informed of the alleged breach, and began conducting an investigation. During this investigation, the UK leaves the EU in a way that EU laws and regulations would not apply to the UK anymore.</p>

<p>If that investigation were later come to the conclusion that the company would have been required to report the breach, would the EU have the right to fine the offending company?</p>

<p>This is an interesting question. The general rule in common-law systems is that the law at the time of the alleged offense applies, <strong>unless</strong> the law that makes a change explicitly provides otherwise. So this might depend on the exact terms of the parliamentary action by which the UK withdraws from the EU.</p>

<p>However, it is worth noting that the GDPR applies, or at least purports to apply, to non-EU entities which are processing data of people who are in the EU. The hypothetical UK company would still come under that provision, although it is unclear, at least to me, how this would be enforced.</p>

<p>By the way, my understanding is that in EU member states fines are imposed by national authorities, so if any fines were to be imposed under the GDPR in this hypothetical case, they might well be imposed by the UK, not the EU.</p>

<p>In this situation, EU regulations will cease to be law in the UK the minute that the UK leaves the EU. However, the UK has been preparing for this and at the same moment, all those regulations should be replaced with UK laws (properly modified where necessary). So assuming the UK can get their act together, everything will stay the same. </p>

<p>EU directives on the other hand are not law, but all member states of the EU are supposed to create their own laws implementing the EU directives. These laws are UK laws today, and they will stay UK laws.</p>

gdpr hypothetical