Data Adequacy Decision should be secured from EU as soon as possible

3 July 2018

The Exiting the European Union Committee publishes its report on data flows and data protection after Brexit.

Ability to move data 'of huge importance'

As the UK leaves the EU, it will also leave the legal framework for moving data between the UK and the EU. The UK needs to act to ensure data flows can continue uninterrupted between the UK and the EU, for the benefit of businesses and consumers, say MPs.

The ability to move data is of huge importance in today's digital world. For many sectors, from banking to telecommunications to professional services, moving data easily is essential. The UK economy is so closely integrated with the EU economy that three quarters of the UK's cross border data flows are with EU countries.

Data Adequacy decision

The Committee's report says that to ensure data flows between the EU and the UK can be maintained after 29 March 2019, the UK Government should start the process to secure a Data Adequacy Decision from the EU as soon as possible.

The EU has an established legal process by which the European Commission examines the data protection laws of a third country (a country outside the EU) and its international commitments to establish whether it provides a level of protection which is essentially equivalent to that of the EU. If so, the Commission can give a 'decision of adequacy' which allows data to flow into and out of the EU without the need for other safeguards. Without an adequacy decision, individual businesses and institutions will have to rely on alternative legal mechanisms that are bureaucratic and create costs and delays.

As a third country starting from a position of complete convergence with EU data standards, the UK is well placed to receive an adequacy decision. The Committee says that the chances of an adequacy decision, and a close relationship with regard to how data protection laws evolve in the future, would be enhanced by the UK accepting the jurisdiction of the European Court of Justice in data protection law. This might help secure a future role for the UK's Information Commissioner on the European Data Protection Board, which is highly desirable if the UK wants to be involved in how EU data protection evolves in the future.

And then, in the future, the UK would be on a strong footing to seek a two way agreement on data between the UK and the EU signed as a Treaty, rather than a one-way adequacy decision made by the European Commission. Both would require an assessment of the UK's data protection regime by the EU.

Transition and timetable

However, an adequacy decision is not automatic and, because this is the first time a Member State has chosen to leave the EU and then seek an adequacy decision, the timetable is difficult to predict. There is a risk that it could take longer than the transition period, so to ensure as smooth a transition as possible, and to give certainty to businesses and consumers, the Committee urges the Government to initiate the procedure as soon as possible, and to establish whether it could start the process while still a Member State.

Data sharing for policing and law enforcement cooperation

Furthermore, as a third country, it is unlikely that the UK could continue to share data on policing and security matters without an adequacy decision. So as the UK is asking for an unprecedented relationship on data sharing outside the EU, securing an adequacy decision would be a good first step to reaching such an agreement that would help maintain cooperation between the police and law enforcement agencies throughout Europe.

Chair's comments

The Chair of the Committee, Hilary Benn MP, said:

"The ability to move data between the UK and the EU after the UK leaves the EU is 'mission critical' for the UK's trading relationship. In the Prime Minister's Mansion House speech, she said the UK had 'exceptionally high standards of data protection' and emphasised that the UK wanted to 'secure an agreement with the EU that provides the stability and confidence for EU and UK business and individuals.' As a first step, the UK needs to request an Adequacy Decision from the EU. This will help not just business but also our future security relationship which is vital to both the UK and EU.
The UK must take steps urgently to enable data to flow between the UK and the EU on the same terms as now, with no gaps in service. UK citizens also need to be reassured about what will happen to their personal information once we exit the EU; they deserve the highest level of data protection – just as they have now."

Further information

Image: iStockphoto