Press play to listen to this article
The United Kingdom has secured a data flows agreement with the European Union worth billions in annual trade. But will it keep it?
The agreement finalized by Brussels on Monday will allow Europeans’ personal data to continue to flow to the U.K. unimpeded, avoiding a cliff-edge scenario that might have cost the British economy as much as £1.6 billion.
But the U.K. government is considering diverging from the EU’s strict data rules if it means a boost to its digital economy — which could imperil the deal, known as an “adequacy decision.” (The European Commission decides if a non-EU country’s data protection rules are up to scratch, or “adequate.”)
“Bluntly, the U.K. is threatening the adequacy decision even as it is being put into action,” said Jim Killock of the Open Rights Group, a nonprofit that has long been critical of the U.K.’s privacy standards and its surveillance powers. “The Commission should have pushed for concessions on surveillance in order to ensure that adequacy is less prone to legal challenge.”
That tension is part of the broader question over Brexit: Should the U.K. stick to EU rules and benefit from the trade relationship with the bloc, but be tethered to Brussels, or diverge to carve out a new path for itself and risk billions in trade?
A report by a key task force advising the U.K. government on how to deal with digital issues, now that it is free of EU regulation, recommended revising its laws to boost the data brokers industry, and to make it easier for companies to process data by moving away from the “principle of citizens-own data.”
John Whittingdale, the country’s data minister, said last month, “If this dialogue we are undertaking shows that there is a greater prize, and that we want to diverge, even if it might put that at risk, then that is something that we certainly do not rule out at this stage.”
For its part, the European Commission pressured Europe’s national regulators and the European Parliament to get the deal done. “Not adopting the adequacy decisions in a situation where we will have a close trade and security relationship with the U.K. would penalize the EU,” the Commission told the Parliament in a letter reported by POLITICO.
Opposition to the deal is running high. Privacy campaigners on both sides of the Channel fret that the U.K. is set on watering down standards that they say already fall short of the mark, and some are already raising funds to challenge the decision.
They will feel emboldened by successful challenges to similar data flows deals with the United States, which EU judges shot down because they said U.S. snooping powers fell afoul of EU privacy standards.
The European Commission says it can suspend the deal if the Brits stray too far from the EU’s privacy rules, the General Data Protection Regulation (GDPR). The EU and the U.K. have to renew the data sharing agreement in four years time, which allows the EU to reassess the U.K.’s privacy rules, and could decide not to renew it.
“It will be possible to suspend or to stop or to amend the decision,” said EU justice chief Didier Reynders in a call with reporters on Monday. “If there are some changes in the U.K. against the EU rules and so if we see a real divergence, it will be possible to react very fast.”
The Brits’ response on Monday after the decision did little to allay those concerns. The government promised to “minimize burdens on organizations seeking to use data.”
The approval on Monday caps off an already fraught process.
Both sides had to buy themselves extra time to get the decision done, bolting on a temporary, six-month solution to the wider trade deal when the Brexit transition ended in 2020. That stopgap runs out in a matter of days.
A U.K. court ruling against the government’s practice of exempting immigrants from being protected by its privacy laws risked the deal at the last minute. The Commission introduced a workaround for it.
Still, the agreement does allow for some flexibility, EU officials said.
“We don’t ask to continue to apply exactly the same system,” said Reynders, the EU justice commissioner, noting that countries did not have to copy and paste the GDPR in order to clinch a data flows decision.
It’s unclear what kind of kind of changes, if any, the U.K. will make to its data protection rules. For its part, the Commission said it won’t respond to noise about divergence, only to “concrete facts.”
“No one should assume that the story ends here,” said Jon Baines, a data protection specialist at London law firm Mishcon de Reya.
Want more analysis from POLITICO? POLITICO Pro is our premium intelligence service for professionals. From financial services to trade, technology, cybersecurity and more, Pro delivers real time intelligence, deep insight and breaking scoops you need to keep one step ahead. Email [email protected] to request a complimentary trial.
48 total views, 2 views today