• Cloud
• Government

Written by Jeremy Lilley, Policy Manager at techUK

As highlighted in techUK and UK Finance’s report on a future data sharing agreement between the UK and the EU, mutual adequacy agreements represent the best option to ensuring the continued free flow of data post-Brexit.

It is increasingly clear that data underpins 21st century trade. In a modern digital economy, the ability to trade in goods and services and do business cross-border is closely linked to the movement of data across national boundaries. For goods and services to flow, data has to flow too. But governments also have a responsibility to their citizens to ensure that any personal data that is transferred overseas is subject to high standards of protection. The importance of maintaining the public’s trust in data protection will mean that regulatory approaches to cross-border data will be just as important as tariffs in future international trade.

Given the number of different businesses and sectors that now powered by data the importance of maintaining the free flow of personal data must be a priority within the Brexit negotiations. The impacts of losing the legal framework to allow the flow of data could have serious impacts for both the UK and EU27 economy. That is why techUK has joined forces with UK Finance to publish “No Interruptions Please: Options for the Future UK-EU Data Sharing Relationship” a detailed paper looking into the options for the future UK-EU data sharing relationship.

With the UK becoming a ‘third country’ once it leaves the EU additional legal mechanisms will have to be put in place to enable cross-border data transfers. Post Brexit, a secure and robust legal mechanism to enable the lawful transfer of personal data across borders will be a fundamental enabler of the UK’s ability to trade not just with EU Member States but the rest of the world.

However, time is not on our side. These will be complex discussions and the time for securing a deal to ensure that the free flow of data can continue unimpeded the moment the UK leaves the EU is limited. Both the UK government and the EU need to be ready to make swift progress once the second phase of the negotiations, on the future relationship between the UK and the EU begins. This paper seeks to assist these discussions by laying out some of the actions needed.

There are three options for facilitating data flows between the UK and EU post-Brexit:

1. No deal – Companies in the UK and EU become reliant on burdensome, expensive and unstable legal mechanisms to transfer data, hindering their ability to trade. As the paper explains, this would be a terrible outcome for organisations of every size and sector, with incredibly burdensome requirements for businesses. Negotiations should seek to avoid such a situation if at all possible.

2. Bespoke Data Flows Agreement – A bespoke relationship, based on the principles of mutual adequacy and enhanced cooperation, could be negotiated, as has been suggested by the UK Government. This is an innovative approach and if achieved would secure the desired outcomes. However, it is not clear whether it is achievable or whether the EU would accept this approach.

3. Traditional Mutual Adequacy – The UK and EU could adopt mutual adequacy decisions, as set out in the incoming General Data Protection Regulation, which would ensure data can continue to flow as it does now.This process, whilst time consuming, is well-understood and utilises an already established process. It seems likely that this is where negotiations will end up. Both parties need to be prepared for this situation when talks begin.

Whatever the process, the issues with negotiating mutual adequacy remain the same. There are lessons to be learned from when similar situations have occurred in other international agreements on data. For example, one crucial issue of which negotiators will need to be aware is the difficultly in discussing national security in the context of such discussions. However, experience with the EU-US Privacy Shield demonstrates that these discussions can happen in a constructive manner, and issues can be resolved. Given the limited time available, and depending on the process chosen, a transitional arrangement between the UK and EU is likely to be required in order to prevent any gap in data flow arrangements.

Firm action and political good will is required on both sides to achieve the ultimate outcome of mutual adequacy. Among other things, the UK Government must consider concerns surrounding the Investigatory Powers Act, and the European Commission needs to acknowledge that domestic security is ultimately a concern for the EU27 as well. Additionally, both sides must put in place the considerable resources necessary to reach a solution in the timeframe available.

As we make clear in this report this will not be a simple issue to resolve as part of the Brexit process. It will take time, flexibility and both sides to recognise the overwhelming mutual interest in an agreement. We therefore urge both the UK and the EU to begin discussions to guarantee data flows as soon as practicably possible.

Comments are closed.