The status of U.K.-EU data flows post-Brexit has been the subject of speculation since the fateful vote was taken nearly two-and-a-half years ago. But with the prospect of the U.K. crashing out of the EU without an orderly withdrawal agreement growing ever-more realistic, concern is mounting.
Legal experts and even the U.K.’s own Information Commissioner have doubted whether the U.K. would be able to achieve an adequacy decision. On Oct. 23, Margot James, the U.K.’s digital minister, finally admitted to a House of Commons select committee that she could not categorically guarantee an adequacy agreement with the EU.
Shadow Digital Minister Liam Byrne was alarmed, tweeting, “Holy cow. Ministers have just told they can’t guarantee the adequacy agreement that allows data sharing across the EU in event of no deal Brexit! That could jeopardise 70% of U.K. services exports!”
The British government has repeatedly said it wants to achieve a data-sharing agreement that even goes beyond adequacy. “There was some debate about whether this might be the basis of an agreement between the U.K. and EU or reliance on an adequacy decision which of course is unilaterally made by the European Commission,” Labour MP Darren Jones said.
Jones repeatedly pressed ministers on whether they were actually confident of securing an adequacy agreement in the event of a “no-deal Brexit."
"Ministers know as well as we do that it's not just the European Commission that is going to sign this, or the European Parliament, it’s the Article 29 Working Group and the European Data Protection Supervisor. And so given the imminence of Brexit, I am extremely concerned that we heard nothing about a timetable. Nothing about confidence levels. So the question is blunt, in the event of a no-deal Brexit, are the ministers prepared to guarantee that data adequacy agreement will be secured and free data flows will continue?” he asked.
“I can't give a categoric assurance that an adequacy agreement will be in place at any particular point during the negotiations,” James responded. “What I can tell him is that the U.K. government has made quite clear to the Commission that we are ready to commence discussions on a future adequacy agreement even if the Commission has not indicated that it is yet ready to start such discussions. We will, if we are successful in securing the transition implementation period, stand ready to begin these preliminary discussions on an adequacy assessment during that period. Indeed we stand ready now, but the Commission has indicated it is not yet ready,” she continued.
James added that although the government’s primary goal was to secure adequacy, she believed that there were suitable provisions in place to allow for “the free transfer of data during the period under which we are discussing adequacy, but have yet to secure adequacy.”
“But the trouble is I don't know. I can't give a cast iron timetable because of course I can't speak for the European Commission, the vital party to such discussions. The ball is in their court,” the minister admitted.
“We're scheduled to leave the European Union at the end of March next year. We anticipate an implementation period that will take us a further 20 months. And we anticipate that discussions on an adequacy decision will take place during the transition and implementation period,” James repeated.
James attempted to reassure the committee that the U.K. will be “100 percent aligned” with the GDPR on Brexit Day and said she was “optimistic that an adequacy decision will not take the usual length of time it has taken the Commission to bestow on other third countries.”
The U.K. will be classified as a so-called “third country” after Brexit, but its application of the GDPR is not a guarantee of an adequacy decision. Leaving with the EU without a deal would mean leaving with no data-sharing agreement in place. Without an adequacy decision, data could only continue to be transferred based on alternative safeguards set out under GDPR, namely standard contractual clauses.
However, in the Nov. 14 draft withdrawal agreement, the future relationship with the EU is described in just seven pages and refers to “essential equivalence” rather than adequacy. It is also highly unlikely that Prime Minister Theresa May will be able to get even this thin proposal through Parliament.
Hogan Lovells Partner Eduardo Ustaran, CIPP/E, said that while “the government position represents a very firm commitment to always maintain EU data protection standards no matter what, securing adequacy status is not easy.
“The prospects of a prompt adequacy decision by Commission before the end of 2020 hinge on how it views the Investigatory Powers Act. The Commission is scrupulously thorough in its adequacy vetting process, and even a special arrangement along the lines of the U.S. Privacy Shield would have to stand up to scrutiny,” he told The Privacy Advisor.
“Another key question for the U.K. would be whether the Information Commissioner’s Office could continue to play a role in the European Data Protection Board. Given the current Brexit negotiations, that is optimistic. It would be very forward-looking of the EU to allow for that special relationship to materialize,” Ustaran added.
Paul Breitbart, director of strategic research at Nymity, agrees: “Legally speaking, the U.K. has a thorough data protection regime, and obviously a well-respected supervisory authority. That all pleads in favor of a quick adequacy assessment after Brexit. The elephant in the room is however the surveillance legislation, which, while the U.K. is part of the EU, is not relevant at all, but will need to be taken into account once the U.K. becomes a third country. It may seem unfair, but it is also unavoidable.
“The European Data Protection Board will base its opinion on the case law of the Strasbourg and Luxembourg courts, and the U.K. will need to show they respect the four essential guarantees identified by the WP29 in the past. It could be that the current oversight mechanism for the Investigatory Powers Act is sufficient, but I can’t rule out that it is not. In any case, adequacy should not be part of a political deal, since the EU in general does not negotiate on fundamental rights,” he concluded.
Only 11 jurisdictions in the world have been declared adequate; whether the U.K. will be the 12th is by no means certain, even with full GDPR alignment.
photo credit: vonderauvisuals via photopin