As the UK leaves the EU, it will also leave the legal framework
for moving data between the UK and the EU. The UK needs to act to
ensure data flows can continue uninterrupted between the UK and
the EU, for the benefit of businesses and consumers, say MPs.
The ability to move data is of huge importance in today’s digital
world. For many sectors, from banking to telecommunications to
professional services, moving data easily is essential. The UK
economy is so closely integrated with the EU economy that three
quarters of the UK’s cross border data flows are with EU
countries.
Published today, The progress of the UK’s negotiations
on EU withdrawal: Data, says that to ensure data flows
between the EU and the UK can be maintained after 29 March 2019,
the UK Government should start the process to secure a Data
Adequacy Decision from the EU as soon as possible.
The EU has an established legal process by which the European
Commission examines the data protection laws of a third country
(a country outside the EU) and its international commitments to
establish whether it provides a level of protection which is
essentially equivalent to that of the EU. If so, the Commission
can give a ‘decision of adequacy’ which allows data to flow into
and out of the EU without the need for other safeguards. Without
an adequacy decision, individual businesses and institutions will
have to rely on alternative legal mechanisms that are
bureaucratic and create costs and delays.
As a third country starting from a position of complete
convergence with EU data standards, the UK is well placed to
receive an adequacy decision. The Committee says that the chances
of an adequacy decision, and a close relationship with regard to
how data protection laws evolve in the future, would be enhanced
by the UK accepting the jurisdiction of the European Court of
Justice in data protection law. This might help secure a future
role for the UK’s Information Commissioner on the European Data
Protection Board, which is highly desirable if the UK wants to be
involved in how EU data protection evolves in the future.
And then, in the future, the UK would be on a strong footing to
seek a two way agreement on data between the UK and the EU signed
as a Treaty, rather than a one-way adequacy decision made by the
European Commission. Both would require an assessment of the UK’s
data protection regime by the EU.
However, an adequacy decision is not automatic and, because this
is the first time a Member State has chosen to leave the EU and
then seek an adequacy decision, the timetable is difficult to
predict. There is a risk that it could take longer than the
transition period, so to ensure as smooth a transition as
possible, and to give certainty to businesses and consumers, the
Committee urges the Government to initiate the procedure as soon
as possible, and to establish whether it could start the process
while still a Member State.
Furthermore, as a third country, it is unlikely that the UK could
continue to share data on policing and security matters without
an adequacy decision. So as the UK is asking for an unprecedented
relationship on data sharing outside the EU, securing an adequacy
decision would be a good first step to reaching such an agreement
that would help maintain cooperation between the police and law
enforcement agencies throughout Europe.
The Chair of the Committee, MP, said:
“The ability to move data between the UK and the EU after the UK
leaves the EU is ‘mission critical’ for the UK’s trading
relationship. In the Prime Minister’s Mansion House speech, she
said the UK had ‘exceptionally high standards of data protection’
and emphasised that the UK wanted to ‘secure an agreement with
the EU that provides the stability and confidence for EU and UK
business and individuals.’ As a first step, the UK needs to
request an Adequacy Decision from the EU. This will help not just
business but also our future security relationship which is vital
to both the UK and EU.
The UK must take steps urgently to enable data to flow between
the UK and the EU on the same terms as now, with no gaps in
service. UK citizens also need to be reassured about what will
happen to their personal information once we exit the EU; they
deserve the highest level of data protection – just as they have
now.”
