And data shall flow! EU and UK step towards post-Brexit data adequacy accord (albeit lacking entente cordiale)

A post-Brexit digital trade level-playing field between the UK and the European Union (EU) is one step closer today after the European Commission confirmed it has begun its long-delayed acceptance that British data protection levels are indeed adequate.

Following Brexit at the start of last month, a missing element was a data adequacy agreement that would allow data flows between Britain and EU states to go on without hindrance or resort to costly mechanisms such as Standard Contractual Clauses. As part of the EU, the UK was a signatory to data protection rules that covered all members states as well as European Economic Area (EEA) countries. But on 31 December, the UK  became a ‘third country’ and as such the automatic right to transfer data freely was no longer the case.

The absence of an adequacy arrangement as part of the ‘Christmas Miracle’ last minute EU-UK Trade and Co-operation agreement came about despite the UK having confirmed it would adhere to GDPR (General Data Protection Regulation) and amidst suspicion among some European politicians about British intentions with regard to surveillance legislation plans.

A six month transition period was agreed to address this issue which had serious implications for future trade on both sides of the English Channel. As diginomica noted back in January:

The lack of a data adequacy agreement to allow for the free flow of data between the UK and the EU would strike a major blow to the digital economy of both parties and beyond. From the UK’s perspective alone, 11.5% of global cross-border data flows go through the country, with three-quarters of that heading to and from the EU.

But this afternoon, the Commission said that after assessing the situation, it has reached the blindingly obvious conclusion that yes, the UK does offer an “essentially equivalent level of protection” to that guaranteed by GDPR as well as under the Law Enforcement Directive.

Tensions

That said, there’s clearly still some suspicion over in Brussels as the adequacy decision is only good for four years, at which point the UK’s then data protection regime - and, unstated in the formal announcement, its surveillance practices - will be subject to review prior to a presumed renewal. Věra Jourová, Vice-President for Values and Transparency, said:

Ensuring free and safe flow of personal data is crucial for businesses and citizens on both sides of the Channel. The UK has left the EU, but not the European privacy family. At the same time, we should ensure that our decision will stand the test of time. This is why we included clear and strict mechanisms in terms of both monitoring and review, suspension or withdrawal of such decisions, to address any problematic development of the UK system after the adequacy would be granted.

For its part, the UK, which had already agreed to the free flow of data from the EU, is clearly relieved that Brussels has finally reciprocated, but irritated it's taken so long. Oliver Dowden, Secretary of State at the UK Department for Digital, Culture, Media and Sport, said:

Although the EU’s progress in this area has been slower than we would have wished, I am glad we have now reached this significant milestone following months of constructive talks in which we have set out our robust data protection framework.

The next step, after taking the opinion of the European Data Protection Board into account, will see the European Commission request the go-ahead from Member States' representatives in the so-called comitology procedure, whereby EU law is modified or adjusted within "comitology committees" chaired by the European Commission. Following that, the Commission should, barring unforeseen problems, adopt the final adequacy decisions for the UK.

Relief

UK tech associations expressed their relief that the matter finally seems to be reaching a positive conclusion. Julian David, co-CEO of techUK, said:

The European Commission decision that the UK’s data protection regime offers an equivalent level of protection to the EU GDPR is a vote of confidence in the UK’s high data protection standards. Today's decisions are warmly welcomed by the tech sector which has been making clear the importance of a mutual data adequacy agreement since the day after the referendum. Receiving data adequacy, alongside the EU-UK Trade and Cooperation Agreement, will set a solid foundation for digital trade with the EU, including strong non-discrimination clauses and positive data flows provisions, that will give businesses the confidence to invest. As we go forward, the UK must also complete the development of its own international data transfer regime, allowing UK companies not just to exchange data with the EU, but also to be able to access global opportunities.

Meanwhile Steven Kelly, Chair of Tech Nation, which represents UK technology entrepreneurs, added:

The positive adequacy decision between the UK and the EU brings great news to the tech sector, following months of waiting and contingency planning in the bridging period. It supports the continued growth of tech scale-ups and the position of the UK as a global leader in data-driven technologies. As we look ahead at building back better, the international flow of data will be vital to fuelling the next wave of business innovation and driving transformation in our society.”

My take

Good news, although even today the simmering tensions between the two sides aren’t far beneath the surface.

The Commission’s version of the announcement includes a comment on the need to “future proof” the agreement from changes, backed up by comment from Didier Reynders, Commissioner for Justice, warning the UK that “EU citizens' fundamental right to data protection must never be compromised when personal data travel across the Channel”. 

Meanwhile, as well as Dowden’s pointed “slower than we would have wished” comment, the UK’s spin on the delayed agreement can’t help but point out that British authorities had provided Brussels with all the necessary information for the decision “nearly a year ago at the start of the adequacy assessment in March 2020”, adding :

The UK made its representations to the EU in a timely manner, but the Commission did not finalise draft decisions in time to complete the adoption process by the end of the transition period.

The UK statement goes on to urge the Eurocrats to pull their administrative fingers out now:

The UK government now urges the EU to swiftly complete this technical process for adopting and formalising these adequacy decisions as early as possible.

Not exactly the entente cordiale one might hope for, but at least the deal, the very, very necessary deal, is done.