Call for Evidence

The House of Lords European Affairs Committee, chaired by Lord Ricketts, has launched an inquiry into data adequacy and its implications for the UK-EU relationship. The inquiry will focus on how current arrangements are working in practice, including benefits and shortcomings, as well as the possible implications of any divergence in the respective data protection regimes of the UK and EU. 

Background

In June 2021, the European Commission granted ’data adequacy’ to the UK following its exit from the European Union (EU), allowing the free flow of commercial and criminal investigation related personal data from the bloc to continue under the General Data Protection Regulation and the Law Enforcement Directive. These decisions will need to be renewed after four years (by June 2025) and could be withdrawn at any point in the meantime, should the EU assess that data protection in the UK falls significantly below the EU’s standards and fails meet the EU test of ‘essential equivalence’.

If the EU were to withdraw its adequacy decisions, maintaining data flows between the UK and the EU would become less straightforward for businesses and, therefore, impact the UK economy.  There could also be an impact on UK-EU security cooperation as it could lead to restrictions on the flow of data for law enforcement purposes between the UK and the EU.

Contributing evidence

The Committee encourages anyone with expertise in or experience of the matters under consideration in its inquiry to submit written evidence.

Diversity comes in many forms, and hearing a range of different perspectives means that committees are better informed and can more effectively scrutinise public policy and legislation. Committees can undertake their role most effectively when they hear from a wide range of individuals, sectors or groups in society affected by a particular policy or piece of legislation. We encourage anyone with experience or expertise of an issue under investigation by a Select Committee to share their views with the Committee, with the full knowledge that their views have value and are welcome.

If you wish to contribute your experience and expertise to this inquiry, please use the questions below as a basis for your response. There is no obligation to answer every question, or every topic.

Questions

1.What is your assessment of the existing adequacy arrangement underpinning data flows between the UK and the European Union?

a. What is your assessment of the value of the EU’s adequacy decisions to UK organisations?

b. How are the General Data Protection Regulation and the Law Enforcement Directive working in practice? What extra costs do they impose on businesses?

c. How would you assess the overall performance and effectiveness of the Information Commissioner’s Office (ICO) as the UK’s independent data regulator? Has its work been impacted by decisions on data adequacy?

2. What are the possible challenges to UK-EU data adequacy regime?

a. What factors could influence the next European Commission when deciding whether to renew its data adequacy decisions for the UK in June 2025?

b. What factors could the Court of Justice of the EU (CJEU) consider if the legality of the EU-UK adequacy decisions were challenged?

c. How would you assess the possible impact of proposed UK rules on automated decision-making and the use of Artificial Intelligence on data adequacy?

3. What implications, if any, would a no or disrupted UK-EU data adequacy scenario have?

a. Do you have any concerns about the direction of travel of the UK Government’s data policies as set out in the Data Protection and Digital Information Bill, and about the potential for greater divergence from EU data standards?

b. How high is the risk of the European Commission withdrawing its UK data adequacy decisions? What impact would that have and how prepared are businesses or the public sector for such a scenario?

c. What would be the implications for the continued operation of Part III of the TCA (law enforcement and judicial cooperation on criminal matters)?

4. What can be learned from other countries’ experience with the adequacy system and engagement with the European Commission’s process?

a. What conclusions do you draw from the European Commission’s recent adequacy review of 11 countries and territories?

b. Are there examples of best practice which the UK could learn from in the way other countries approach their data transfer arrangements with the EU?

c. What are the implications for the UK’s EU adequacy status if the UK grants its own adequacy decisions to other third countries currently not subject to EU adequacy?

d. If the UK joined the Global Cross Border Privacy Rules system, what impact if any could that have on the UK’s EU adequacy status?