The UK Government has just published a ‘future partnership paper’. It covers the exchange and protection of personal data, following the UK’s exit from the EU in March 2019. The paper confirms that the UK will implement the EU’s new data protection framework (GDPR) into UK domestic law. This will happen before its exit from the EU. This means that, when the UK leaves the EU, its domestic data protection law will be aligned with the EU’s. A bill is currently making its way through parliament to implement GDPR.
However, the UK Government also acknowledges that, after the UK leaves the EU, it’ll need to agree new arrangements to govern the free flow of data between them. The UK government wishes to explore a new UK-EU model for exchanging and protecting personal data to provide stability for businesses, public authorities and individuals. This would allow the UK regulator (the Information Commissioners Office) to maintain effective regulatory compliance with the other EU information regulators.
The UK’s data economy is worth a potential £240 billion, according to the CBI. Ensuring an agreement with the EU to allow the continued free flow of personal data, and to provide legal certainty for businesses, is a key issue for the UK economy as a whole.
The UK Government wishes to do this via an ‘adequacy agreement’. This would mean that the EU Commission decides that a third country (which will be the UK after exit) has data protection laws in place that provide adequate safeguards to protect the data of EU nationals being transferred.
The EU Commission has entered into similar ‘adequacy agreements’ with other ‘third countries’, like Israel and New Zealand. In the absence of such a decision (and agreement) from the EU, commission simplified transfers of data would not be allowed between the UK and the EU after UK exit.
The UK Government’s paper sets out a number of alternative options for transferring data. But, it confirms that these would mean significant difficulties for all UK businesses involved in data transfer. The best option (which the UK Government is hoping for) is that the UK will obtain an adequacy decision from the EU Commission that’ll come into effect once the UK has exited the EU.
This brings us to the ticking clock. While Big Ben may no longer be ticking, the Brexit clock most definitely is.
From the end of March 2019, the UK will be a third country. But, negotiating an ‘adequacy agreement’ will probably take longer than the 19 months that the UK has left in the EU. Discussions about this might not even start until the UK has sorted out the ‘divorce bill’, and the issue of EU citizens’ rights following Brexit. While some progress has been made on citizens’ rights, there has been very little progress so far on the divorce bill.
The UK Government’s paper, while welcome, will simply have to wait in line until the EU is ready to consider it. This may not be for quite a while yet. Uncertainty for business in this area can only increase.
We’re presenting several seminars and courses on the impact of the GDPR. Further information can be found here.