D-Day for Brexit - but does the 'd' stand for data adequacy or for disaster?

As D-Day looms for Brexit negotiations and a hard No Deal looks increasingly on the cards, the absence of a data adequacy agreement should be as high up the agenda as fishing quotas and the prospect of the south of England being turned into a giant container lorry park…but it isn’t.

Or at least it’s not dominating the mainstream media headlines where, as of this morning (Monday 7 December), UK Prime Minister Boris Johnson appears minded to walk away without a trade deal with Brussels, reluctant to sign up to last minute terms and conditions from European Union (EU) members.

It is however high up in the concerns of those in the tech sector who realise the potential implications of a break from the EU without a data deal in place and was the subject of an expert roundtable chaired by the Institute of Government think tank last week.

As of this morning, the UK has agreed to observe existing regulations, including GDPR (General Data Protection Regulation), but Europe has not reciprocated with an adequacy agreement. The European Court of Justice has previously voiced concerns about UK handling of personal data and there’s a considerable suspicion of Britain’s Regulation of Investigatory Powers (RIP) Act, which many on the continent see as akin to the overreach of US surveillance powers.

So, although the UK is already aligned with data protection law in the EU, there’s no guarantee that the crucial data adequacy agreement will be offered. That would be highly problematic, observes Anthony Walker, Deputy Chief Executive of British trade association techUK:

Data adequacy is the mechanism that provides a legal basis for the lawful transfer of personal data cross border between the UK and the EU. Given the size and scale of a trade between the UK and the EU, obviously data fundamentally underpins that trade. So it's a really important mechanism that underpins our trading relationship with with our European neighbours. If we don't have an adequacy agreement, then there are other mechanisms that businesses can put in place to have that kind of legal basis for that lawful transfer, but they're more costly and cumbersome and potentially less enduring. So if we don't have an adequacy decision, then that has quite significant implications for the extent to which data can flow cross border.

As to what he sees the chances are for securing an agreement, Walker says bluntly:

This is a question that we've been obsessed with since the day after the [Brexit] referendum. The fact is, we've just got to wait and see. I think it's entirely possible that we could get a an adequacy agreement, but first of all we have to see what happens with the negotiations around the Free Trade Agreement and the exit deal. If there is an agreement and we leave with a deal, that significantly improves the prospects for getting an adequacy agreement. But time will be very short and it seems unlikely that there is enough time for a final decision on adequacy to be agreed.

That doesn’t mean that come 1 January 2021, data will stop flowing between the UK and the EU, at least not immediately. It’s possible that a draft decision could go the European Data Protection Board for an opinion, suggests Walker. That would take time to come through, in which case some form of transitional agreement, perhaps in the form of a Memorandum of Understanding, could be put in place to maintain the status quo.

Is there a mood to do a deal?

Jenny Tennyson, Vice President and Chief Strategy advisor at the Open Data Institute, which works with companies and governments to build an open and trustworthy data ecosystem, can see that there are concerns on both sides of the Brexit negotiating table:

The EU doesn't want to grant data adequacy only for [the UK] to change our regime a little down the line and it needs to withdraw it again. We also see hints about potentially needing to relax or have some flexibility in order to enter into trade deals with other countries and be able to have free flow of data with those other countries, which again is a kind of warning sign around data adequacy.

She adds:

You have to recognise that that's also difficult for [the UK] Government. It's in the middle of these trade negotiations, it doesn't want to show its hand too much. It's also needing to understand what its resources are. Some of these decisions around digital identity and around how you balance data protection while protecting citizens in particular against security threats, they are difficult things to navigate. It's not as if there's an obvious answer around these things, so it's not surprising that it takes some some time to work those things out. But I hope that we can get some acceleration of that.

For his part, techUK’s Walker believes both sides recognise the benefits of a deal:

The European Commission really would like to see an adequacy agreement because it means that the UK stays in the EU's orbit a bit and it means that the UK remains broadly aligned with EU policy. It's not part of the EU, but it's kind of on a piece of elastic...but at some stage, it breaks. That breaking point is a constraint on what the UK may do in terms of diverging away from the European model and so geopolitically that's incredibly valuable to the European Union. So there are very good reasons why the European Union would want to have an adequacy agreement with the UK, and why it's good for global alignment around core norms around things like human rights.

The UK is now on a journey of building a new global trading relationship. We've already got a number of rollover, free trade agreements, but it's looking to build out. This is kind of putting together that jigsaw puzzle as it were, a trade agreement. The opportunity in a way for the UK is to be that bridge between the EU and GDPR and the rest of the world…The opportunities for the UK are in this kind of this broader framework for governance for digital economy, thinking about the ethics, how the ethics need to impact the development of new law and legislation. If it can do that, I think it can still have a global leadership role. It can have an influence on some of the direction that the EU takes as well.

A UK leadership role?

Walker adds that a post-Brexit Britain still has a major role to play in future debate around data protection issues and standard that other nations would welcome:

When we talk to our counterparts around around Europe, other technology trade bodies around Europe, they're certainly concerned about not having the UK ‘in the room’. They felt that the UK has been a very constructive voice around around the digital economy, and especially being quite pragmatic and helped lead a lot of the thinking about digitalization in the EU. I think that that that voice will be will be missed. I think what we're seeing is other member states, who may be used to wait for the UK to come forward first, are realising that they're possibly going to have to move forward in terms of raising their thoughts and concerns and organising a bit, particularly some of the smaller member states.

There is an influential role for the UK to play in data issues, agrees Jay Scott Marcus, Senior Fellow at Bruegel, an independent European think tank which aims to improve the quality of economic policy:

The UK has historically been a great progressive, pro-market, pro-competition force and in all of these discussions, it'll be missed. Many of the countries closest to US views - I think especially Scandinavian countries, the Netherlands - they really already miss the fact that the UK hasn't been so much in the discussions over the past year. I personally will miss the UK. I do a lot of work with electronic communications. The framework in place in all of Europe is largely a UK design from 2002.

So the UK has played a tremendous positive role and I think it's very regrettable that the UK won't be so visible. This issue of digital platforms [such as Facebook and Google], many of which are US based, is very much on the radar in the UK, in the EU 27 and also in the USA. New regulatory approaches, new policy approaches, new approaches to competition law are really likely in all three, hopefully reasonably well-aligned between the three. At the moment, the signs are good that things are moving in similar directions, but the devil will be in the detail.

Throw into the mix here, the imminent arrival - Trump tantrums excluded - of the Biden administration in the US. Marcus argues:

What I really hope can happen is now that we have a new administration in Washington, that we see a constructive dialogue between EU and US, and also the UK, EU and US, to try to come up with a judicially sustainable framework. That would be the good case. In that case, adequacy decisions could be maintained all around.

So what’s stopping all this from happening? If there’s so much at stake - for both negotiating parties - what’s the sticking point? The answer to that ironically may lie, in part at least, in one of Europe’s data protection success stories - GDPR, as discussed here.