Plenty of questions around data transfers emerged within the U.K. following Brexit, and it seems the privacy industry is starting to get some answers.
In June, the European Commission adopted a pair of adequacy decisions for the U.K., and now the British government has laid out a new slate of initiatives to clarify the picture even further.
The U.K. plans to strike independent data adequacy decisions with its international partners, with the goal of delivering alternative data transfer mechanisms and to remove barriers for international data flows.
"In doing so we want to shape global thinking and promote the benefits of secure international exchange of data. This will be integral to global recovery and future growth and prosperity," writes U.K. Secretary of State for Digital, Culture, Media and Sport Oliver Dowden and Minister for Media and Data John Whittingdale.
The U.K. has developed and implemented policies and processes for reaching adequacy agreements with its partners, and has identified 10 countries as "priority destinations" for these deals. The countries include Australia, Brazil, Columbia, The Dubai International Financial Centre, India, Indonesia, Kenya, The Republic of Korea, Singapore and the U.S.
The government laid out four steps for determining U.K. adequacy. First, the government will determine whether to launch the process with a given country, after which an assessment process will take place where information will be collected pertaining to the level of data protection in the area. Should the country in question pass this step, a recommendation will be made to the Secretary of State who will make the decision that will ultimately be laid before Parliament.
"The U.K. is starting to show that there is room for diversion from EU data protection law whilst still retaining the GDPR as a framework. What this means in practice is that the way in which international data flows are approached is not identical to the way the same data flows are treated in the EU, but this doesn’t necessarily mean that the protection is going away,” said Hogan Lovells Partner Eduardo Ustaran, CIPP/E.
As the U.K. takes on these initiatives, it will do so with a slate of fresh faces ready to help. The Department for Digital, Culture, Media & Sport announced it will launch an International Data Transfers Expert Council to "provide independent and expert advice, of both a technical and tactical nature, which will enable the government to deliver on its mission to champion the international flow of data."
The DCMS is seeking 15 individuals from academia, industry and civil society to fill out the council. The department is accepting applications for the council until Sept. 12, and is looking for candidates who can provide "independent, expert advice to the U.K. government on international data transfers policy" and have relevant experience working with data transfers, data protection and international data policy.
The U.K. Information Commissioner's Office will play an important role in developing the new slate of adequacy agreements, as the Secretary of State must consult with the ICO before making any decisions. When the U.K. starts kicking into high gear with its new initiative, the world should expect a new commissioner to be at the helm of the ICO.
New Zealand Privacy Commissioner John Edwards was named by the DCMS as the preferred nominee to serve as the next information commissioner. Edwards would succeed Elizabeth Denham, whose tenure at the ICO will end later this year. He is set to appear before members of the DCMS Select Committee Sept. 9.
"There is a great opportunity to build on the wonderful work already done and I look forward to the challenge of steering the organisation and the British economy into a position of international leadership in the safe and trusted use of data for the benefit of all," Edwards said in a statement.
"Implementing any changes Parliament decides on will fall to my successor, who will take on a role that has never been more important or more relevant to people’s lives," Denham said in a statement. "John Edwards would bring extraordinary breadth, international leadership and credibility to this role. He will receive the support of a modern, independent ICO that has the courage, resources and expertise to make a positive difference to people’s lives.”
Ustaran said the potential appointment of Edwards would dictate the direction the U.K. might take with data protection.
"What the U.K. government is testing is our ability to recognise that the protection of personal data around the world comes in different shapes and forms, but can still be effective," Ustaran said. "The appointment of John Edwards as the next information commissioner is a vote for no-nonsense and pragmatism for the future of data protection regulation."
The data transfer landscape was thrown into complete disarray when the Brexit vote came down five years ago, and while all the answers did not come overnight, the picture is slowly, but surely, coming into focus.
Photo by King's Church International on Unsplash
