Exiting the European Union Committee 

Oral evidence: The progress of the UK’s negotiations on EU withdrawal, HC 372

Wednesday 9 May 2018

Ordered by the House of Commons to be published on 9 May 2018.

Watch the meeting 

Members present: Hilary Benn (Chair); Mr Peter Bone; Joanna Cherry; Stephen Crabb; Mr Jonathan Djanogly; Richard Graham; Peter Grant; Wera Hobhouse; Andrea Jenkyns; Stephen Kinnock; Jeremy Lefroy; Mr Pat McFadden; Craig Mackinlay; Seema Malhotra; Mr Jacob Rees-Mogg; Emma Reynolds; Stephen Timms; Mr John Whittingdale; Hywel Williams; Sammy Wilson

Questions 1562 - 1692

Witnesses

I: Giles Derrington, Head of Policy: Brexit, International and Economics, techUK; Elizabeth Denham, Information Commissioner; Stephen Hurley, Head of Brexit Planning and Policy, British Telecom; James Mullock, Partner, Bird & Bird.

II: Dr Bleddyn Bowen, University of Leicester; Colin Paynter, Managing Director, Airbus Defence and Space UK; Patrick Norris, Secretary of the European Affairs Group, UK Space.

Examination of witnesses

Witnesses: Giles Derrington, Elizabeth Denham, Stephen Hurley and James Mullock.

Q1562  Chair: First of all, on behalf of the Committee, can I extend a very warm welcome to our witnesses this morning, the first of two panels that we are having today?  This one is on data and the future UK-EU relationship.  Can I welcome James Mullock, partner with Bird & Bird, Elizabeth Denham, the Information Commissioner, Stephen Hurley, head of Brexit planning and policy at British Telecom, and Giles Derrington, head of policy: Brexit, international and economics with techUK?  You are all extremely welcome.  Thanks for coming today. 

We have a lot of ground to cover; therefore, short questions and succinct answers would be really helpful.  Please do not feel under an obligation, all of you, to answer every question; otherwise, we will have difficulty in getting through what we want to cover in the time that is available.  I just want to begin myself by asking, given the state of play currently, how worried we should be about our ability as a nation to carry on moving around data in the way that we do currently as a result of Brexit.  In other words, do you think this is going to get sorted, or are you anxious about it? 

James Mullock: I am fairly anxious.  My clients are fairly anxious.  It is quite hard to imagine the impact on business and the disruption that this area could cause, but we had a little flavour of it in 2015 when the safe harbour arrangement was struck down by the ECJ.  That led to a two or three-month period where several tens of thousands of companies were looking for patches to make their transfers to the US adequate.  If we have anything like that it will be extremely disruptive and it will be extremely off-putting in terms of businesses looking at where they will headquarter themselves in Europe and therefore the long-term prospects for attracting businesses from many of the sectors that this country supports so well.

Elizabeth Denham: I would say that getting the data policy right is of critical importance, both on the commercial side, but also on the security and law enforcement side.  We need data to continue to flow and if we are not part of the unified framework in the EU then we have to make sure that we are focused and we are robust about putting in place measures to ensure that data continues to flow appropriately, that it is safeguarded and that there is business certainty in advance of our exit from the EU.  Data underpins everything that we do and it is critically important.

Stephen Hurley: Speaking as BT, the impact of Brexit on data flows is rating as one of our top two or three concerns at the moment.  That both relates to our customers, but also our internal processes, such as our HR and billing systems.  It is a cause for concern for us at the moment.  I echo what the other panel members said around the planning and uncertainty that this causes us.  We have to put in place certain contingency planning potentially to deal with the uncertainty if we do not get an adequacy deal or some similar deal quite soon.

Giles Derrington: I certainly echo that.  For the tech sector it is certainly seen as mission critical, but for other sectors as well it is absolutely vital.  In terms of our ability to get it, we are more confident now than we were six months ago.  Any sense of complacency would be highly problematic from our point of view, in that this is a very political negotiation.  It will have to happen both within the negotiations, but also with the European Parliament as well.  From our point of view where the Government have got to is very good, but it is going to take a lot more effort on top of that to get it over the line.

Q1563  Chair: Thank you.  You said in order to “get it”.  My next question is about what “it” is, because a data adequacy decision, which is a term I certainly first heard when we met techUK very early on in the life of the Committee, is a regulatory decision by the Commission in respect of a third country.  When we took evidence from DExEU Ministers they talked about a data agreement.  Is it your understanding that it is possible to override what would otherwise be a data adequacy decision by the Commission in respect of a third country by incorporating it in an agreement that is reached between the UK and the EU.  What is your understanding as witnesses about what it is likely to be?  Will it be an agreement or a decision by the Commission?  I do not know who wants to go first. 

James Mullock: It has to be a treaty.  There are several reasons from a process point of view why I say that, but one of the reasons is, if it is integrated as part of an international treaty, it then increases the chance of it withstanding attack in the future.  I mentioned earlier the Schrems decision against Privacy Shield.  My understanding is that if we were to agree something as a matter of international law then that would add a layer of protection in terms of what European courts could do or not do if they felt that the level of adequacy was sufficient or insufficient.

Q1564  Chair: You are saying an agreement is preferable to a decision.

James Mullock: I am saying a treaty is preferable to a decision.  We should take what we can get, but a treaty is the ultimate standard to aim for.

Elizabeth Denham: I would say that a bespoke agreement or a treaty is preferable, because that implies mutual recognition of each of our data protection frameworks.  It contains obligations on both sides.  It would contain dispute mechanisms.  If we look at an adequacy decision by the Commission, that is a one-way decision judging the standard of UK law and the framework of law to be adequate according to the Commission and according to the Council.  An agreement would be preferable, but it would have to be a standalone treaty or a standalone agreement that is about data and not integrated into a trade agreement because of the fundamental rights element of data protection.

Q1565  Chair: Not to be part of a trade agreement.  I can see nods.  They need to be separate and standalone?

Elizabeth Denham: That is right.

Q1566  Chair: In other words, we would be looking at potentially a number of treaties, apart from the withdrawal agreement, if you are arguing that this should be covered separately.  Mr Derrington, do you concur with that?

Giles Derrington: Yes, absolutely. The evidence is very much that trying to get data into free deals has not worked with the EU, most recently with the EU-Mexico agreement, and we would not want to go down that route considering how hard it is, particularly because trade deals are about trade and there are a large number of people within the EU institutions who view this as a rights issue and that this is a fundamental right to data protection, so is not a subject for trade. 

Q1567  Chair: Does the transitional period give sufficient protection to mean that we have until December 2020 to get that kind of deal or agreement or treaty in your view, or are there any things you are worried about during the transition?

Stephen Hurley: I could perhaps comment from a BT perspective.  On the data flows element, transition is designed to mirror the status quo, so that would work.  Data flows could go both ways.  Where it is possibly deficient is the role for the ICO, which we consider is very important.  The ICO has a very important role as part of the European group of regulators currently.  As we understand the transition period, that would no longer potentially be the case, possibly.  Others may have views on that.  Where that is important to us is we have a very close relationship with the ICO as a company that has a large establishment in the UK but operations globally, and we would be worried that the ICO would no longer be part of that group.

Q1568  Chair:  We will come to that in questioning a little later.  Finally from me, in the absence of either a data adequacy decision or a treaty then what does the fall-back look for companies and the current flow of data?

Elizabeth Denham: The fall-back would mean that individual organisations would have to rely on the other transfer mechanisms that are in law, such as standard contractual clauses, binding corporate rules, codes of conduct and certification and consent.  What that would mean is each organisation would have to look at the appropriate transfer mechanism and the burden would be on that organisation to use those tools.  To my colleague’s point, there is a challenge right now in the courts against standard contractual clauses, which is probably the mechanism that a lot of particularly small and medium businesses would use in this scenario. 

Q1569  Chair: If that challenge were successful then we would be in a lot of trouble in the absence of an agreement or a treaty or a decision.

Elizabeth Denham: We would.  We would have to rely on those other transfer mechanisms, which is consent on a transactional basis for the transfer of data.  Again, that is a burden on business.  That is legal advice.  The ICO would step in as best we could to be able to educate businesses and organisations in the UK as to the best transfer mechanism, but it would be more burdensome than having a bespoke agreement, a treaty or an adequacy finding.

Chair: That is very clear.  Thank you very much.

Q1570  Stephen Kinnock: Good morning.  Could you just say a little bit more about what is required in order to secure an adequacy decision?  What are the criteria?  How is adequacy defined?  Could you just unpack that a little more for us?  I am not sure who would be best placed to answer that question.

Elizabeth Denham: It is clear in law.  Article 45 of the General Data Protection Regulation outlines what components or considerations the European Commission will look at in making an adequacy decision or recommendation.  They will look at the data protection law, the independence or not of the data protection authority, the administration of the law, the activities of national security and intelligence agencies and whether or not there was protection and redress for EU residents in that kind of scenario.  We have seen some of this play out in other adequacy assessments, but under the GDPR we can expect more robust scrutiny by the European Commission under now the new law, under the GDPR.  Perhaps my colleagues have something to add to that.

James Mullock: That is a very good summary.  There is an adequacy mechanism also in relation to the Law Enforcement Directive, so there is a separate mechanism in relation to the sharing of information about witnesses, suspects and those involved in criminal proceedings.  In terms of the points that are looked at, that was a good summary and we can talk about the process as well, which is what has traditionally taken so long.  Generally these decisions take on average about two years to run through the various bodies that need to look at those criteria, but in terms of the criteria that is a good summary.

Q1571  Stephen Kinnock: You are saying that, assuming that negotiations on this do not really start in earnest until we have left the European Union, you would normally expect it to take two years for us to receive that adequacy decision based on previous experience.

James Mullock: That is based on previous experience.  The only exception to that was Privacy Shield, which was pushed through a lot quicker, but then people could see the court case coming and a lot of work went into the process in the run-up to the decision.  Otherwise, yes, that is the average length of time.

Q1572  Stephen Kinnock: There is a possible scenario there, assuming that we start in April 2019 on that process, that it would not be completed until April 2021, which is four months after the end of the transition period.  What do you think would happen in that interim period?  Would we be left in a vacuum or are there some other interim measures that could be taken?

James Mullock: We would be left with the other measures that the Information Commissioner mentioned, in terms of binding corporate rules, contracts and using Privacy Shield.  I have seen some debate as to whether the process would have to wait until April to commence and whether it could not be commenced earlier, but to do that the various European bodies would need to be assessing what the state of UK law would be at the point of Brexit, and that might be something that they would struggle with.  I guess there is the potential that you could argue that maybe an early start to the process should be possible.

Elizabeth Denham: The good news is that if the Data Protection Bill finds its way to the statute book, which is so incredibly important in this whole discussion, then on the date of exit the UK is going to be in a very good place to be able to check a lot of the adequacy boxes, and in a better state than any other third country could be. 

The important thing to do would be to frontload the work and be ready for the assessment on the more difficult questions, because we are going to have equivalent law with the GDPR and the Data Protection Bill.  You have a strong, independent regulator, who is administering the law of the land.  We have a good story to tell when it comes to adequacy, but work could begin before that time, so that the UK is ready to have those more difficult discussions about national security, intelligence services and data.  We have seen those discussions play out in the Privacy Shield assessment.

Stephen Hurley: If I might add, from a business planning perspective, from our side it is not so much that adequacy at some point in time would not be available to the UK if that is the choice the Government make.  It is more the risk of a gap at some point in the process because of the time it takes.  As you pointed out, there is a risk that at the end of transition there may be some period of months or possibly longer where there is no adequacy decision in place, where we have to rely on the other transfer mechanisms that the Information Commissioner mentioned.

Giles Derrington: If I may very quickly, the Prime Minister in her Munich speech said that the UK Government are ready to start some of these discussions now and the interim work.  We thought that was quite sensible.  We are keen to see what the next steps of that are.  We do not quite know yet.  Starting some of that process before we leave makes sense—at least the preparatory work—because quite a lot of this stuff is about getting the structures right for negotiations, because often you are having to discuss classified information in a non-classified process.  When we have spoken to our colleagues in America, they said that one of the biggest challenges for time: setting up processes that allowed a conversation, which allowed the Commission to do a proper assessment of whether particular national security aspects were in line and were adequate.

Q1573  Stephen Kinnock: I have just one final question, if I may, Chair.  You are saying that the first step is for us to have the GDPR on the statute book.  That is a crucial part of this process.  What would you estimate would be the latest we could have or should have the GDPR on the statute book in order for all of the other dominos to fall in the way that we would want them to?

Elizabeth Denham: The GDPR has direct effect, so there is not a requirement in national law to bring in the GDPR, but what the Data Protection Bill does is completes the implementation of the GDPR and fills in the white space that member states can make decisions on, for example age of consent for children, the balance between privacy and freedom of expression and the powers of the Commissioner.  The powers of the Commissioner are contained not in the GDPR, but the Data Protection Bill.  It is really important that the Data Protection Bill finds its way to the statute book and also brings in the Law Enforcement Directive, which does not have direct effect.  That is a directive, and it requires member state law to bring the Law Enforcement Directive into UK law.  That is another very important aspect of the Data Protection Bill, which as you know is at third reading today.

Q1574  Mr Djanogly: Elizabeth Denham mentioned the alternatives to the UK receiving a data adequacy decision.  Could we go a little bit more into the main drawbacks of each of those alternatives? 

James Mullock: Bureaucracy.  They required papers to be signed.  They require, in the case of standard contractual clauses, an individual agreement to be put in place between a company that is transferring data and the business that receives it.  In the case of binding corporate rules, they require a company to implement a policy to GDPR level and to have that approved; that is a very time-consuming process.  Generally it takes my clients at least 18 months for them to clear that process.  Essentially, you are putting the burden on business to find a legal agreement or a legal mechanism to agree data protection standards on an overseas recipient.  All UK businesses that receive data from Europe will be having to sign these agreements or put in place these mechanisms to receive data from the European Union, which is one of our very major senders of data to this country.

Q1575  Mr Djanogly: Mr Hurley, what would your issues be?

Stephen Hurley: Bureaucracy and burden is definitely key.  From our perspective, to give a sense of scale, we have over 18,000 suppliers.  If we were to put in place standard contractual clauses it would be a subset of those suppliers, but we would have to identify where the flows of data would be coming from, in particular from the EU to the UK, and put in place those contractual clauses. 

The other problem with the contractual clauses is they are a set form.  They are a precedent form that the Commission issues and, again, that is not necessarily designed to deal with the modern ways of doing business and the way flows of data occur in practice.  It is quite a cumbersome process. 

I would just add uncertainty as well, given they are currently under challenge before the European courts.  A lot of companies now are already doing a belt-and-braces, where even if you rely on Privacy Shield you will also put in place an alternative transfer mechanism to allow you to have a fall-back in case one gets temporarily removed.

Giles Derrington: Certainly bureaucracy.  For example, when the safe harbour collapsed with the US we had a member company who had to put in place 2 million standard contractual clauses over the space of a month or so.  The amount of cost, time and effort that took was very significant.  That is for a very large company. 

The other side of this is the alternatives are highly exclusionary or could be highly exclusionary to smaller businesses.  If you look at India, for example, which has been trying to get an adequacy agreement with the EU for about 10 years, what you have found now is a gap with those large multinationals that can put in place binding corporate rules and standard contractual clauses and have the kind of capital to be able to do that.  It gives them an access to the European market that frankly most smaller businesses do not have from India.  We would not want to see that in the UK tech sector, which is an awful lot of start-ups and scale-ups and is a key part of the ecosystem that makes the UK a tech hub within Europe.  It will have a knock-on impact down the chain as well.

Q1576  Mr Djanogly: How would having to use the alternatives affect different sectors of the economy and different sizes of business, Ms Denham?

Elizabeth Denham: To reiterate the point about binding corporate rules, that might work for multinational companies that have the ability to invest in that process.  Codes of conduct and certification are other transfer mechanisms that could be used, but there are very few codes of practice and certification mechanisms in place at this time.  Although that could be a future transfer mechanism, we do not have codes and certification that have been approved by authorities at this time.

Q1577  Mr Djanogly: It is sounding to me like we are able to identify the problems but not quantify them.

Elizabeth Denham: That is probably correct, but again, it would be easier for multinational companies and large companies, rather than small businesses and certainly microbusinesses that make up the lion’s share of business in the UK, especially in tech.

Q1578  Stephen Timms: Can I first of all put a question to Mr Mullock?  You spoke at the beginning about what happened when safe harbour was struck down in the courts.  Can you tell us a little bit more about that, because people did not stop communicating data, did they, when that decision was made?  Was there some sort of legal fix that was done on an emergency basis so that people could carry on, or did they just carry on pending a potential legal challenge?  What happened?

James Mullock: As the Information Commissioner mentioned, there is a list of options when it comes to how to achieve adequacy in the absence of a decision for a country.  People looked down the list and looked at the alternatives.  If they had previously transferred data to a safe harbour certified US company, they put in place a model contract with them.  As Giles was mentioning from techUK, there were a large number of contracts that had to be rolled out very quickly to patch that position.

Q1579  Stephen Timms: Did anyone stop communicating data because of that decision?

James Mullock: Not to my knowledge.  I suppose what was happening in some businesses was they were taking the compliance risk and carrying on in the hope that they would be cut some slack by regulators, who would appreciate the difficult position they were in, but would expect them to be seen to be moving and trying to patch the position.  I doubt very much that transfers stopped, but there was a ticking clock as we went through the period from October into beyond Christmas where companies were very keen to put in place these alternative mechanisms.

Q1580  Stephen Timms: Things could probably carry on for a whole, but eventually it would be a big problem.

James Mullock: That was the case then.  There you had businesses in every country in Europe affected by this issue, so it was a pan-European issue.  There is a slight difference between that and a UK-only position, but yes. 

Q1581  Stephen Timms: Can I just take you back to the question that the Chair raised at the beginning about whether what we are talking about is a technical assessment process by the Commission, or are we talking about a negotiation as part of a trade agreement?  My understanding from your answers was that you tended to take the view that it would be preferable if data adequacy could be in a trade deal, but Mr Derrington, in particular, was sceptical about whether in practice that is achievable.  Mr Derrington, is how I understood what you said correct?

Giles Derrington: To clarify, we are talking about a treaty, not a trade deal, for starters, which are two different things.  Even if we have a treaty approach to this, we would certainly expect there to be a technical exercise as part of that, partly because, as I say, there are those within the Commission who view this as a fundamental rights question and not as a subject for negotiation and not for a trade-type discussion.  They would seek to apply probably the same process as an adequacy process, where effectively we have to prove that our national security apparatus is secure and that third country transfers are not happening to places not deemed adequate by the EU.  Those things would remain the same. 

The difference is in a treaty you can bring in the additional adequacy-plus questions of the role of the Information Commissioner, the UK’s participation in the one-stop shop and those kinds of issues, which are necessary for businesses to have true confidence that they will be able to continue and that in the long term the alignment works and can function correctly.  Ultimately, the fall-back is just to get an adequacy agreement, because that is the thing that fundamentally breaks data from flowing.

Q1582  Stephen Timms: Some people in the Commission take that view.  One of them appears to be Mr Barnier, since he made a speech at the beginning of March when he talked about the adequacy decision as an autonomous EU decision.  He went on, “There can be no system of mutual recognition of standards when it comes to the exchange and protection of such data”.  I just wonder, Mr Mullock and Ms Denham, whether that perspective, if that is the one that prevails in this, makes it difficult to achieve what you were saying earlier you hoped would be achieved?

Elizabeth Denham: A bespoke agreement or the treaty option, which gives us more than adequacy, including a role for the ICO at the European Data Protection Board and participation in the one-stop shop, which would be really advantageous to business, would have to be negotiated.  Again, Mr Barnier’s comments were in the context of a negotiation.  An agreement to go forward on data would have to be negotiated, because otherwise we would be looking at what is already in law, which is an adequacy assessment, and that would make us the same as any third country. 

The point the Government are making and the point that all of the witnesses today are making is that the UK could strive for something more appropriate, which better reflects the integration of our economies and the integration of our security and policing initiatives.  That would be a bespoke agreement or a treaty that sits alongside a trade agreement.

Q1583  Stephen Timms: What is your assessment of the willingness of the EU to enter into such a negotiated agreement?  We know they are talking about data in the context of discussions with Japan and Korea, and perhaps they are moving more in the direction of negotiation over these matters than has been the case in the past.  Are you very confident that they would be willing to negotiate this, or is there an element of doubt?  How would you characterise the position?

Elizabeth Denham: I am not close to the negotiations at all, so that is a question for Government.  Again, just on a factual basis, the UK is in a different position than Japan, South Korea, Canada or New Zealand when it comes to the proper arrangement for data.  That is particularly true in the law enforcement and security context.  It has to be beneficial to both sides to come to an arrangement.

Q1584  Stephen Timms: Can I ask any of the other three on the panel what your assessment is of the willingness of the EU to negotiate this matter, as opposed to applying a technical assessment?

James Mullock: Again, I do not know the answer to willingness.  If I could rephrase it slightly to, “What is in it for them?” what is in it for them is avoiding the bureaucracy that we have described that all companies faced when safe harbour was struck down. 

Secondly, I echo the point about it being slightly different to South Korea, India or New Zealand, in that there is such a long history of data protection, the formulation of policy concepts and an extremely large regulator in this country that has contributed to the growth of the area of law over recent years.  With the GDPR all regulators across Europe are going to have a huge burden in meeting, enforcing and guiding people through this regulation, so that is also a benefit that the UK can bring to Europe.  Those two are very key.

Q1585  Stephen Timms: Mr Derrington, you made the point that they were not willing to negotiate with Mexico. Do I understand you correctly?

Giles Derrington: In a trade deal context and a free trade agreement, no, it has fallen out of both the Mexico agreement, despite them holding a place for it in the text, and indeed the Japan-EU free trade agreement as well.

Stephen Timms: It has fallen out.

Giles Derrington: The original draft text of the EU-Mexico agreement, for example, had a space for data flows within it, as a holding paragraph.  In the updated text that has been lost.  The same thing happened in the Japanese deal.  It simply fell out of the negotiations.  There was no ability to agree.

Q1586  Stephen Timms: We had understood that there is a negotiation with Japan on this.

Giles Derrington: That is an adequacy process.  They sought to do it within a free trade agreement and when they failed to do so they used an adequacy process as their fall-back option. 

Just very quickly on the question of how willing the EU is to negotiate, our assessment is that individual countries are probably more willing to enter into a bigger negotiation than purely adequacy at the moment.  We are doing, certainly, a lot of work as techUK, with some of our sister organisations in those member states, to articulate that, partly because if UK is not part of the one-stop shop then EU-27 businesses will need to have someone in the UK in order to form part of the ICO regulatory framework, so that they are compliant with the UK’s version of GDPR.  There are knock-on consequences for Swedish businesses, Polish businesses or whomever in that.  There is a better understanding at member-state level. 

At the Commission level there is still the idea, “We have an adequacy agreement”, and certainly in the current context of negotiation that is where they are.  We would hope that to shift, both on the business case but also, as others have mentioned, on the security case.

Q1587  Stephen Timms: If an agreement is reached on data adequacy, how likely is it that there will be a legal challenge from somewhere to it?

Giles Derrington: Given the challenges that have happened in the past, we would expect there to be a challenge ultimately.  This is why it is really important that this is done, first, quickly so that there is no gap that can create challenge events, as it were, but also that it is done in a process that is as binding and strong as possible, so via treaty would be the best approach because that is a concept of international law rather than a question of whether we have met every single process in a slightly different forum.  We would expect it, but it is overcomeable.

Q1588  Hywel Williams: Good morning.  Can I ask you about an earlier answer that you gave to the Chair and to Mr Timms?  Regarding this point that a trade agreement is a trade agreement and data should be handled separately, do you think that will provide any problems for businesses in respect of the notion that nothing is agreed until everything is agreed.  In terms of sequencing and timing, would that be problematic? 

Giles Derrington: Not necessarily.  It depends on when you start and how quickly you can go through the process.  Broadly speaking, from our point of view—and this goes wider than the EU deal, into other potential free trade agreements that the UK might want to strike—we have said that you need to get the data bit right first, because effectively it is the plumbing.  Certainly for the tech industry, you cannot open up any market if you cannot have free flow of data.  If they are acting in parallel that makes sense, but you need to get it over the line in order for a free trade deal with the EU or anyone else to really have direct economic value.

Q1589  Hywel Williams: Can I ask another question, perhaps to Ms Denham?  It is a concern that I have about security and civil liberties issues, and it is a case in point.  Lockheed Martin won the contract for the 2011 census and there were concerns at the time that as an American company it would be subject to the Patriot Act and then UK—that is EU—citizens’ data would then become available to the US Government and to their agencies.  That was sorted out adequately from what I remember.  I am not a lawyer, but there was an agreement. 

There is a further census we have in 2021.  Is it going to be more complicated, in that we will have possibly 3 million EU citizens not in their own countries but living in the UK, who are legally required to provide information to the Government if an American company, such as Lockheed Martin, won the contract?  Do you think it will be the easiest thing in the world to sort potential problems out for those 3 million EU citizens and for UK citizens, for that matter, as well, or would that be complicated?

Elizabeth Denham: It might be complicated anyway, but what is really important is to get the Data Protection Bill in the UK on to the statute book.  We will have the direct effect of the GDPR.  If we are outside of the European Union then we are going to also have to have a protective onward transfer regime in place and that could be a replication of the Privacy Shield, for example.  There will be mechanisms in place for individuals living in the UK to pursue their rights, and that would be through my office and through the statutes.  There will be a framework, but again that onward transfer to the US or other third countries from the UK will be an important part of the work that needs to be done on the data issue.  I do not know if my colleagues want to add to that.

James Mullock: The example you gave shows how quickly things can become very complex and how the more mechanisms you have to make data-processing possible the better it is, while ensuring that people have protection if they have genuine concerns.  Without going into the specifics of the example, it shows why having multiple options for business and rights for individuals is really important.

Q1590  Jeremy Lefroy: Good morning.  If I could ask the Information Commissioner first, how do you anticipate the EU managing concerns some member states have about the UK’s investigatory powers legislation?

Elizabeth Denham: Whether the UK proceeds with an adequacy assessment or whether we go down the road of looking at a bespoke agreement or a treaty, we know, as we have seen with the Privacy Shield, that there will be scrutiny of our intelligence services and the collection, use and retention of data.  We can expect that. 

We have a good story to tell when it comes to our regime.  Parliament has spent a lot of time reviewing the legal framework around our security and intelligence-gathering.  There is a new independent Investigatory Powers Commissioner who has been put in place.  In terms of the High Court decision in April that requires the Government to examine and look for more improvements to the transparency and accountability of our regime, the Government are committed to that and to do that work in the next six months. 

It is not well understood.  Accountability, transparency and oversight of our intelligence service needs to be explained and discussed to our colleagues, but there is no doubt that it will come under scrutiny.  My office was part of the most recent assessment of the Privacy Shield and looking at the US regime, so we are well aware of the kind of questions that are going to be asked, including our arrangement with the Five Eyes, so we have to be ready for that.

Q1591  Jeremy Lefroy: How do our current governance arrangement compare with, say, those in France, if you have that information?

Elizabeth Denham: I cannot speak to the arrangements in France, but if we are outside of the EU and we are seeking a bespoke arrangement or adequacy then it is the UK’s legal regime that will be under review.

Q1592  Jeremy Lefroy: Presumably we would also, as the UK, be concerned about the situation in the EU, because one might say that there are movements in the EU that would give us cause for concern, if not now in the future, so there would be a mutual conversation.

Elizabeth Denham: That is why the bespoke agreement or the treaty that is more of a mutual arrangement and not a one-way review is the better option, because, again, the Government have to protect the rights of UK citizens when their data is collected in the EU.

Q1593  Jeremy Lefroy: Finally, can we only reach agreement on sharing data for policing and security reasons if we have a data adequacy agreement, or are there ways around that?  You have already spoken about a treaty, but let us put the treaty to one side at the moment.

Elizabeth Denham: There are provisions in the Law Enforcement Directive, and if the Data Protection Bill is brought into law then the Law Enforcement Directive will be live.  In law enforcement and security, if there is not an adequacy finding, then there are emergency measures to share information on a case-by-case basis and there are options in the Law Enforcement Directive for bilateral agreements to be struck with member states in the EU.

Q1594  Jeremy Lefroy: Does anybody else want to comment?

Giles Derrington: I just have one quick point.  The security question is not a zero-sum game.  Yes, there is a bespoke process for the Law Enforcement Directive, but if you talk about financial institutions tracking financial crime, including the funding of terrorist organisations, et cetera, that requires them to be able to see the data coming from across Europe.  That would require an adequacy agreement.  Technically the very narrow discussion about security is one thing, but in order to facilitate it more generally you would need the adequacy agreement as well or something similar.

Q1595  Craig Mackinlay: We have seen finally that there is a mutual recognition acceptance by the Commission on data adequacy.  When I look at the list of who has been cleared, as it were, you have microstates like Andorra and the Faroe Islands, you have advanced economies like Israel and New Zealand and you have perhaps some odd ones that I had never thought about, such as Argentina and Uruguay.  This mutual recognition of standards seems to be part of the lexicon of the Commission on data, which is quite unusual for them.  Of those countries that have been through and cleared, have any been kicked out afterwards, after having got through the hurdle?  There is a four-yearly cycle of reinvestigation that they still come up to standard, as it were.

James Mullock: I do not believe so, no.

Q1596  Craig Mackinlay: No.  It is not daft to think that the UK upon departure, having implemented the Data Protection Bill, perhaps this afternoon, and complied with GDPR, is on a level that is completely adequate to the EU.  Honestly, I cannot believe that there would be a situation where we are deemed to be less safe than Uruguay on exit day.  Would that be quite reasonable?

James Mullock: Until you have the certainty of that confirmation, if you are a business you do not know where you stand and you have to take the risk of non-compliance with an area of law now with a very significant fine.

Q1597  Craig Mackinlay: That is not an unreasonable assertion of mine, is it, really?

James Mullock: I agree it makes sense, but if you are that business and you need the certainty and there is an area of law with a very large fine, you would want the rubber stamp for certainty.

Q1598  Craig Mackinlay: If the EU decides to play hard ball during the data part of the negotiations, how would them not accepting the UK as data-adequate damage themselves?  This is not a one-way flow.  This is a bilateral flow of data. 

Stephen Hurley: It would.  There is mutual interest, as you say, in an adequacy decision for the flows in data going in both directions.  I understand from the UK perspective 75% of our data flows are with the EU.  I do not know the figure the other way, but from a BT perspective our offices in Spain, Germany or wherever are accessing HR data based in a data centre in Scotland.  From a BT perspective there is definitely an interest in having the mutual side of it and I would imagine that is replicated in many businesses across the EU.

Q1599  Craig Mackinlay: Perhaps you can just help me.  Mr Hurley, you are the international expert, with BT.  Just on some unusual transactions that happen in this world at the moment, say I have an Uber account.  It works in London.  If I go to Mumbai my Uber account will work in Mumbai.  India is not a part of data adequacy.  How does that work, where you end up paying the local taxi driver through my account that is London registered, probably? 

Number two: when I phone up my bank I could be being picked up in the Philippines, India or wherever else.  These are countries that are not part of the data adequacy.  How does that work?  Is it deemed to be because it is cloud-based on a server in the UK or in the EU that is deemed acceptable? 

The big one is Five Eyes. How does that work within the framework at the moment across the five countries that are part of it, which are Britain, New Zealand, Canada, the US and Australia?  How does that work within the framework if some countries are in data adequacy and some are not?  It seems all quite bizarre that these data flows go on quite happily without all of these bureaucratic complications that we perhaps are hearing today.

Stephen Hurley: You have hit the nail on the head in terms of the complexity of this issue and probably why it is one that we need to look at closely.  I might leave Five Eyes to some of the other panellists, but from a BT perspective how we would share data internally within our network is governed by our BCRs.  These binding corporate rules that the ICO signed off last year allow us to share that data internationally beyond the EU, but we meet the EU standard essentially.  The BCRs are essentially intra-company agreements that say, “Each part of the BT enterprise will treat data to a required standard”, which is an important consideration and we would value that going forward because it really allows us to move data within our business very seamlessly and securely.

Q1600  Craig Mackinlay: How does this odd Uber arrangement that I described work within the framework at the moment, because the local taxi driver is getting his money from the taxi fare?  You can imagine the complication of data flow that goes on with that transaction.  How is that allowed?

Elizabeth Denham: Absolutely.  You are the passenger and you have a complaint about the security of your data.  Where do you take that complaint?  That is the complexities of regulation in a world of global data flows.  You could attempt to take the complaint to the Netherlands, which is where the main establishment of Uber is.  You are an EU resident.  You can take that complaint to Uber and see if they are going to co-operate with that investigation.

Q1601  Craig Mackinlay: The complexity is that there is data that is being processed at a high level for a transaction in India.  How has that worked?  The system, clever as it is and far beyond my comprehension, knows that the local taxi driver is owed 200 rupees from my account in the UK, processed in the Netherlands.  How is that allowed when India is not up to data adequacy in the EU?

Elizabeth Denham: Again, I do not know what Uber’s transfer mechanism is.  It is something we could look at.  It may be using standard contractual clauses or some other mechanism to transfer the data through to India.  You are really asking two different questions.  What is the legal mechanism to allow the data to flow across borders and what is your redress as an individual where you want to take the complaint?  Who do you take the complaint to?

Q1602  Craig Mackinlay: What I am really trying to get at is in the current world that we live in we are totally adequate, because we are in the EU and compliant with everything that has come out, but there is still a vast amount of data about me being processed in countries that do not comply with data adequacy, such as in the bank that has a phone system in the Philippines.  How has that been complied with?  That is the nub of this.

Elizabeth Denham: Again, EU data cannot flow outside of the EU unless there is an adequacy agreement, there is a use of standard contractual clauses and there is a BCR in place.  That is the rule for the EU. Where there are companies that are not complying with that, that is an action that has to be taken by the regulators.  Individuals can bring complaints. 

The point is that, bottom line, UK citizens and UK residents expect the highest level of data protection.  Certainly, when we are leaving the European Union, citizens and consumers expect that Parliament is going to retain those values and those high standards in law, so that we can continue to protect our citizens.  I certainly hear that every day in my office.  I know the deep concerns that UK citizens have had about Cambridge Analytica and Facebook, and they expect that we as the UK regulator take strong action.  What we are talking about here is we cannot necessarily control data flows with the rest of the world, but the rules that we are talking about are about the EU and the protection of data flows beyond the EU.  That is the subject of our conversation today.  How do we get that data policy right, so that we can continue the values that our citizens expect? 

Q1603  Joanna Cherry: Good morning.  I just want to be clear about how we would get to the stage of there being an agreement between the European Union and the UK of the sort you have discussed already.  I think I am right in saying that first the European Commission would require to make a positive assessment of the UK’s data protection regime.  That would be an internal decision by the EU.  I am correct in saying that.  Is that right?

James Mullock: This is if we were applying for an adequacy decision.

Q1604  Joanna Cherry: If we are looking for an agreement, the EU would first have to be satisfied from their point of view that our protections were adequate.  They would first have to be satisfied of that before there could be an agreement.

James Mullock: It seems likely.  No one having done it, it is hard to predict but it seems likely that they would not be able to agree it and a mutual assessment in return.

Q1605  Joanna Cherry: Before you get to the stage of a mutual assessment, the European Union would have to be satisfied of the adequacy of our arrangements from their point of view.

James Mullock: It seems inevitable, yes.

Q1606  Joanna Cherry: Even if the Commission is satisfied and we go on to the stage of there being an agreement between the European Union and the UK, that agreement could still be challenged in the Court of Justice before ratification.  That is right, is it not?

James Mullock: I am not sure that it is.  I would need to check, but my understanding is that if the arrangement is agreed by international treaty then, no, it cannot be, as compared to if an adequacy decision is applied for and granted by the European Commission then it could be.

Joanna Cherry: The safe harbour was challenged.

James Mullock: That was a decision by the European Commission.  It was not an international agreement.

Q1607  Joanna Cherry: Before there is a treaty there has to be an agreement.  My point is that the agreement can be challenged before ratification in the Court of Justice.  That is correct, is it not?

James Mullock: I do not know.

Q1608  Joanna Cherry: That is certainly what the Home Affairs Committee concluded after their inquiry into UK-EU security co-operation: that it is possible to have a challenge to the agreement before the stage of ratification.  I would be surprised if the lawyers on the panel were not able to clarify that as being the case.

James Mullock: I am sorry; it is not my area.

Q1609  Joanna Cherry: An individual or a member state could challenge any agreement in the Court of Justice if they felt there was something wrong with it from a human rights point of view or if they were unhappy, for example, about aspects of the UK Investigatory Powers Act.  That is the case, is it not?

Giles Derrington: If I may, the issue is if you are going through just an adequacy process, yes, that is absolutely correct.  The distinction here is that if we are talking about a treaty process that is a new process, which would be a signed agreement between the EU and the UK then that is a different process because it is happening at international law level.  It would not be going through the same process as an adequacy agreement.

Q1610  Joanna Cherry: I am puzzled.  I will read out to you what the Home Affairs Committee concluded.  They said, “Even if the Commission makes a positive assessment of the UK’s data protection regime, any agreement between the UK and the EU could be referred to the CJEU prior to EU ratification.  Based on the evidence we have received, this has two major implications: first, it may be struck down on the basis of the activities of the UK security services, or the indiscriminate transfer of sensitive data on EU citizens.  Second, it could cause significant delays to the ratification and implementation of the agreement concerned—which could be the proposed security treaty”. 

They go on to quote a professor of EU Law at University College London.  I am going to do terrible violence to his name now.  It is Piet Eeckhout.  He told the Home Affairs Committee, “Any negotiated agreement can be referred to the Court of Justice”.  I am a lawyer.  I am not an expert in European Union law, but that is a pretty fundamental undergraduate tenet of European Union law: that any agreement can be referred to the Court of Justice before ratification.

Stephen Hurley: It is certainly my understanding generally, yes.

Q1611  Joanna Cherry: Any agreement reached by the European Union with a third country can be referred to the Court of Justice before ratification.  I would be astonished if anybody on the panel were to query that as a proposition of law.

Giles Derrington: The point of challenge was the sequencing of the Commission having to agree and then the UK having to agree.  I agree with you on the fundamentals of that.

Q1612  Joanna Cherry: We are agreed that if the UK and the EU reach agreement, that agreement could be challenged by a third party in the Court of Justice.  That is the case, is it not?

James Mullock: Before ratification.

Q1613  Joanna Cherry: Before ratification, yes.  If that were to happen there are two outcomes, which are strike down or acceptance, but in either case there could be a considerable delay before ratification, could there not?

James Mullock: I suppose it depends on the grounds on which it is being challenged and whether those grounds are remediable.

Joanna Cherry: If the challenger wins then the agreement is struck down.  If the challenger loses then the agreement is fine.  It can go forward to ratification.  In either scenario there could be a considerable delay or significant delay before ratification and implementation.

James Mullock: If there is not, the benefit is that you have a more bulletproof, long-term mechanism for the benefit of British business.

Q1614  Joanna Cherry: Indeed, but a challenge to the agreement would involve delay.  That is correct, is it not?

Stephen Hurley: If I could just speak for a moment from a business planning and uncertainty perspective, all of what you have said from my point of view adds to the uncertainty.  No matter what happens outside the EU, any of the mechanisms we agree, whether it is a treaty, whether it is adequacy or whether it is relying on standard contractual clauses, will all be vulnerable in some way to the extent that being within the EU construct is not.  That is just the very nature of where we will be.  What we do need is the best we can get followed by the belt-and-braces approach, where we have additional safeguards if each of these gets taken away over time.

Q1615  Joanna Cherry: Ms Denham, the Information Commissioner, you have talked about the importance of the Data Protection Bill, which we will be voting on later today.  Are you or any of the panel aware that there is a concern that the immigration exemption contained in Schedule 2 of that Bill is not a permissible exemption in terms of Article 23 of the GDPR?  Are you aware of that concern?

Elizabeth Denham: I am aware of the concerns around the immigration exemption and I have made public my concerns about that exemption in our parliamentary documents.  I have expressed some concern about the breadth of that exemption.  Whether that is legally challengeable, I cannot comment at this time.  This is a new exemption.  It was not in the Data Protection Act 1998.  Whenever rights are affected, as the Information Commissioner I am going to have concerns about that.  I understand the public policy reasons for it, but, again, I will be watching this very closely, if it is passed into law, and monitoring it to make sure that it is used proportionately and that people have access to our complaint mechanisms.

Q1616  Joanna Cherry: It is true also to say that there are legal concerns about whether the data retention provisions and the bulk powers in the Investigatory Powers Act would be acceptable to the European Union, in terms of deciding whether there was adequate data protection in the UK. That is a matter that has been before the Court of Justice and is currently heading there.  That is correct, is it not?

Elizabeth Denham: It is correct.  The High Court’s decision on 27 April has made it clear that bulk collection of data is not necessarily disproportionate, but the court had some other recommendations for the Government to look at.

Q1617  Stephen Crabb: Mr Hurley earlier rightly referred to the importance of the current role of Commissioner Denham’s office alongside EU regulators.  The Government’s future partnership paper from last August does propose an ongoing role for the Commissioner’s office when we leave the EU.  What feedback have you had from other EU regulators about that proposal?  I will perhaps ask the Commissioner in the first instance, but also yourself, Mr Hurley.  Have you had feedback from your fellow regulators in the EU about that proposal?

Elizabeth Denham: I have.  It is a group of independent commissioners and regulators that sit around the table.  The ICO is the largest independent regulator in the European Union.  We have more than 500 staff.  We have contributed to the drafting of GDPR guidance in more than 50% of all the documents.  We are very active in enforcement cases.  The Cambridge Analytica-Facebook investigation is being led by the ICO.  The rest of our regulators are telling me, “Good for you.  On you go and we will follow this”. 

Our work is appreciated among my colleagues.  They are concerned about the loss of the ICO’s participation and the ICO’s robust response, enforcement and investigation.  That is what I hear from them, but again, they are not politicians.  They are independent regulators and these are political decision at the end of the day.

Q1618  Stephen Crabb: Would it be highly unusual or indeed unprecedented for a regulator from a non-member state to participate in the EU regulatory forum?

Elizabeth Denham: There are ways to be an observer at the European Data Protection Board, but unless a role for the ICO was negotiated through a bespoke agreement or a treaty there is no way in law at present that we could participate in the one-stop shop, which would bring huge advantages to both sides, and also to British businesses.

Stephen Crabb: Observer status would not cut it, as far as you are concerned.

Elizabeth Denham: It would just mean that we would get to listen to the debates, and at this time, when the GDPR is in its infancy, participating in shaping and interpreting the law is really important.  The group of regulators that sit around the table at the EU are the most influential blocs of regulators, and if we are outside of that group and we are an observer we are not going to have the kind of effect that we need to have with big tech companies, because that is all going to be decided by that group of regulators.

Q1619  Stephen Crabb: Have you picked up any signal from the EU Commission itself about whether it is likely to agree to an ongoing role for your office?

Elizabeth Denham: I have not and that is not my role.  I am speaking about my colleagues around the table.

Stephen Hurley: If I can add, just from a BT perspective and a largely UK business perspective, we would very much welcome a continue role for the ICO.  The ICO to date has approved almost a third of the BCRs that have been approved in the entirety of the EU, so they have a lot of expertise.  They have a strong voice around the table of the European Data Protection Board as it will be.  More fundamentally for us, if we fall out of the one-stop shop mechanism, BT itself will have to look elsewhere within the EU for an ICO equivalent, essentially, to have that role and be our lead regulator in the EU, which again is another burden that we frankly want to avoid.

Giles Derrington: If I may, one of the things we have heard from some of the other Northern Arc countries, particularly the likes of Ireland, is that some of their businesses are worried that, if the ICO is no longer at the table, their regulators will not necessarily have the capacity to write their own guidance.  They quite often mirror UK ICO-approved guidance, so they are worried about, if they are not at the table, where they will get that from?  Do they have to upskill their own regulators quite quickly?  As Stephen mentioned, the one-stop shop is incredibly important for EU companies that trade data into the UK, because they will need to have someone in the UK as well, so there is some concern there.

Thirdly, the GDPR itself has been evolving, as the Information Commissioner said, but also with GDPR mark II there are questions about where we go on things like the regulation of AI across the world.  The EU is setting the global standard at the moment.  There are some attempts to look at other global standards, but really the game in town is the EU version.  If we are not involved in that work as Europe’s biggest tech hub then potentially that work shifts in a different way, which makes it harder for the UK to lead in AI and all the other things that Government and industry want to be able to do.

Q1620  Chair: In a word, if we are not in the room anymore, the UK is going to lose influence.  Is that correct?

Elizabeth Denham: That is correct.  The European Data Protection Board will set the weather when it comes to standards for artificial intelligence, for technologies and for regulating big tech.  We will be a less influential regulator.  We will continue to regulate the law and protect UK citizens as we do now, but we will not be at the leading edge of interpreting the GDPR and we will not be bringing British values to that table if we are not at the table.

Q1621  Chair: Mr Derrington, would you agree that the UK will lose influence unquestionably?

Giles Derrington: Absolutely.  There is no question of that.  The EU could still go in a way that is helpful, but that is more likely if the UK is there.

Q1622  Mr Whittingdale: Can I first of all ask about the existing data protection adequacy recognition system? As has been said, quite a lot of countries have been recognised as having adequate data protection regimes, but your area perhaps more than most is evolving very fast.  How are the existing agreements updated?  Do they have to be reviewed to make sure they take account of new developments within the EU?

James Mullock: It is a requirement of the existing law and under the GDPR that there is a four-year review period, so all of those other countries will be going through a refreshed adequacy assessment.

Mr Whittingdale: Every four years.

James Mullock: That is right.

Q1623  Mr Whittingdale: When the GDPR was under debate within Europe, there were elements of it that the British Government very strongly opposed.  In particular, we felt that it imposed unnecessary cost burdens on large numbers, particularly on small firms.  To what extent is there an opportunity, once Britain is no longer part of the European Union, for us to revisit those elements of the GDPR that we did not agree with in the first place in order to amend them?

Giles Derrington: Yes, you are right.  GDPR is by no means perfect and there are a number of issues that we had with it. Having said that, because GDPR has global reach, it is now effectively being seen as, “We have to comply with this at an international level”, by a number of our largest members, who are rolling it out worldwide, not just Europe-wide. 

The opportunities to diverge are quite limited, particularly in areas like AI.  AI requires massive amounts of datasets, so you cannot do that just from a UK-only dataset of 60 million people, if you took everyone.  You need more data than that.  If you were to use European data, which most of them would, then that would require you to comply with GDPR.  Even if you could do things that would make it easier for some of the AI processes to happen, by doing so you would be closing off your access to the datasets. 

Most of the companies I have spoken to—by no means the entirety because that is the way these things work—see GDPR as, “That is what we are going to have to comply with.  We would much rather it be one rule for the UK and one rule for the EU”, and to be able to maintain access to their datasets, rather than just complying with dual standards: “Oh, we are going to have to meet GDPR anyway”.

Q1624  Mr Whittingdale: You have put your finger on the problem, because you said most of your larger members, and you are speaking for the big companies for whom GDPR is relatively easy to take account of, because they probably already have data compliance officers and a structure in place.  The people who are suffering under GDPR are the very small firms, who suddenly are having to spend money on areas of data protection that certainly it was our view were unnecessary. Where I would hope there might be an opportunity is for us to revisit the impact of the GDPR on particularly small business.

Giles Derrington: There are two things there.  First of all, it is worth bearing in mind that about two-thirds of our members are small and medium-sized businesses, so I am by no means speaking for the larger tech companies.  A small business working in AI still needs massive amounts of datasets, so tech is somewhat different.

The other thing I would say is, from a tech sector perspective, we do not see there being much opportunity to change GDPR, considering where data protection sits in the public consciousness now. That is not necessarily where the centre of gravity among the public is.  If you look at the Data Protection Bill as it went through both Houses, most of the amendments to the Bill were to go further to strengthen data protection law.  We do not necessarily see this idea that we will significantly walk back GDPR. 

Bear in mind that any company that is doing any work with the EU would have to comply with GDPR anyway.  You are talking about quite a small set of companies. Yes, there are burdens, but in terms of that being weighed against everything else and the ability for us to be flexible, we do not necessarily see that being there at the moment.

Q1625  Mr Whittingdale: That is the case for all the European regulation: that if you want to do business in Europe then you will have to abide by European regulation, but there are a vast number of firms that do not do business in Europe and it is those where there might be an opportunity to reduce the burden on them, which certainly in the view of the Government was unnecessary, and without necessarily affecting our adequacy arrangements.  Is it your view that that would put us in breach of the data adequacy requirement?

Giles Derrington: That is probably more of a legal question.  From our point of view, yes.  Any discussion of divergence after the fact would be problematic and we do not see necessarily what we would be able to do to remove burdens of GDPR while complying with the adequacy agreement. 

The other thing I would say is, given that this is a very highly political question within the European Commission and the European Parliament, from our point of view discussions of divergence are not helpful, because those who see this as a fundamental principle of data protection and human rights, as it were, hear the question of, “Can we diverge a bit later on?” as, “We do not take data protection seriously”. 

One of the things that has been really good from the Government is that, as part of the Data Protection Bill process, they put in place Section 2, which says that we view data protection as fundamental and something that every citizen has a right to.  That kind of message is really important for getting this adequacy or adequacy-like approach set.  Those questions of divergence are certainly things that we as a sector are not entertaining now and think could be problematic later on.

Mr Whittingdale: This, of course, goes way beyond your sector and affects all business.

Giles Derrington: Of course it does.

Q1626  Mr Whittingdale: Mr Mullock, from a legal point of view how do you see it?

James Mullock: In my experience the bureaucracy that goes with data protection law comes mainly in the way that it is enforced, not in the way that it is written.  The issue that my clients have traditionally had is different approaches to enforcement across different European countries and that creating uncertainty.  There is an overlap between this point and the previous point, in that what is written in the law is only half the story.  How it is enforced and having the ability for not just enforcement but guidance—because that is also really important in a new area of law, when people are trying to work out where they should take their business, whatever size it is—is really important. Getting sensible guidance and a sensible voice into the guidance-making process is very important.

Q1627  Mr Whittingdale: Perhaps Ms Denham is best placed to answer this.  Do you see any opportunities for you once we are outside of membership of EU?  I understand your concerns about no longer being able to influence the decisions of the European Union, but equally you will no longer necessarily be bound by the decisions of the European Union.

Elizabeth Denham: I appreciate your question and I am smiling because I spent the weekend helping my son, who is an app developer in California, come to grips with the GDPR compliance because he has thousands of clients in the EU, so he is trying to figure out rectification, portability and subject access requests.  Again, the extra territorial reach has impact.

The other thing is the rest of the world is looking at the GDPR, and rising tides float all boats.  The Canadian Parliament is strengthening the law.  Singapore has strengthened its law.  Other countries around the world are looking at the GDPR because of not just the extra territorial reach, but because that is what individuals expect.  Data protection was a very sleepy area of law and a lot of us are happy to get out of the basement to be able to talk about this, but it is really front of mind. 

In terms of opportunities post exit for data protection, as the regulator I will work very hard to ensure that small businesses have the tools they need.  My office gets 2,500 calls on our small business line every week. We have tools that we have issued.  We are working with the Federation of Small Businesses to help them help their members.  I am not a bonkers regulator, so our focus will not be on small business.  We will take action if there are serious behaviours that have to be corrected, but the sanctions, the fines and the new powers for the Commissioner are so that we can take action against serious harm for individuals, especially by larger companies.  That is what it is about. 

I do not really see opportunity to dilute rights.  That is not what Parliament wants.  That is not what citizens want.  We definitely have a strong stream of work to support small businesses, because if you are the corner butcher shop, you are not really going to have data protection issues, but if you are a small tech company, like my son and his health app in California, you sure as heck do.

Richard Graham: I have a very small question, specifically to Mr Mullock.  Earlier you said, in answer to a question about how long it might take to try to reach agreement with the EU on data, that in previous cases it would take about two years.  I just wonder whether there was an opportunity for you to reconsider that answer based on the fact that there is not a precedent for this situation of somebody leaving the EU and effectively then reaching another agreement, and whether you felt that you might have inadvertently set another slightly scaremongering hare running by suggesting that there was going to be a two-year gap with no agreement reached and chaos for companies, whereas what we have heard from you and other witnesses is that if pragmatism prevails and if we pass the GDPR Bill here, there should be a very good base from which to reach some form of treaty with the EU.  I just wondered if you wanted to give your remarks some context.

James Mullock: You are, with respect, mixing treaty and the award of an adequacy decision, and it is important that we separate those two, because the treaty is all the more attractive because of the timing risk on going the other route for an adequacy decision.  Let us just look at the adequacy decision and timing on that and what would be required. I would not change the two-year comment.  The last country was New Zealand.

Q1628  Richard Graham: Is New Zealand remotely comparable to the situation we are in?  What is the precedent for a large member of the European Union leaving the European Union and seeking an agreement on this?

James Mullock: I take your point, but you have to go through a multi-layered assessment, and that is what it is.  It is an assessment as opposed to an agreement.  That inevitably comes with some time lag built into the process.

Q1629  Richard Graham: Although it has been suggested that work on that could start well ahead.

James Mullock: That needs to be looked at, because what you are saying there is that work starts early to assess the state of UK law at the end point, including things like court decisions against the Investigatory Powers Act.  That is by no means a given that that is possible.  It is not just the GDPR.  It is the list of other data-relevant legislation and the case law that has come through in this country that would be assessed as part of an adequacy decision.

Q1630  Chair: I just have one final question.  Does the fact that the Charter of Fundamental Rights is not being read across into UK law as part of the EU (Withdrawal) Bill make getting the kind of adequacy decision, agreement, treaty or whatever, in a word, more difficult, less difficult or does it make no difference? 

James Mullock: More difficult.

Elizabeth Denham: It would have been a good signal to make to the European Union.

Stephen Hurley: I agree it would have been a good signal, but it should not hopefully make a difference in practice.

Giles Derrington: I agree, although Section 2 of the Data Protection Bill is a significant step.

Q1631  Chair: Sorry; just for clarity, what do you agree with?

Giles Derrington: I agree with the rest of the panel, but Section 2 is important in that.

Q1632  Sammy Wilson: I just have one quick question for Mr Mullock.  Mr Mullock, just on your last answer about all the assessments of the adequacy of legislation at present, we already have data flows between the EU and the UK as part of our membership of the EU.  All of the legislation, therefore, that you are saying would need to be assessed must have already been assessed; otherwise, we would not have that.

James Mullock: No, because the law starts from the point that it is fine to share data within Europe.  If you want to share data outside of the European Union then you bring in the adequacy question.  It is only assessed at the moment if someone brings a case or brings a claim.

Q1633  Mr Whittingdale: Very quickly on the Chairman’s question about the Charter of Fundamental Rights, you talked about your regret because it would have sent a good signal, but in practical terms does our not incorporating the Charter of Fundamental Rights into British law through the Bill have any impact on your ability to do your job?

Elizabeth Denham: No, it does not have a direct impact, but our office has always been supportive of a separate fundamental right for data protection and for it not to be bound up in privacy and family life.  It is a fundamental right, but it is not an absolute right.  It always has to be considered with other rights, such as freedom of expression.

Mr Whittingdale: It is for the sake of clarity that you would like it.

Elizabeth Denham: We have always supported it in terms of clarity and as a separate and distinct right.

Joanna Cherry: The Charter contains data protection and privacy rights protections that are not in the Convention on Human Rights.  That is correct, is it not?  You are nodding.  Thanks.

Chair: That concludes this particular panel.  You can tell from the questions that have been asked that that has been a really useful and informative session.  On behalf of all the Committee members, we are very grateful to you for coming today, giving up your time and answering with such clarity.  We will now move straight on to the second panel.

Examination of witnesses

Witnesses: Dr Bleddyn Bowen, Colin Paynter and Patrick Norris.

Chair: We now move on to our second panel. It gives me very great pleasure to welcome Colin Paynter, managing director, Airbus Defence and Space UK, Patrick Norris from CGI, former chair of UK Space, and Dr Bleddyn Bowen, lecturer in international relations from the University of Leicester.  You are all very welcome.  We have a lot of ground to cover, so as succinct answers as possible would be really helpful. 

Could I begin by asking, particularly Mr Paynter and Mr Norris, to give us the latest position as regards contracting by UK-based firms for Galileo work?  What is happening?  What can you do?  What can you not do? 

Patrick Norris: British industry has been under contract directly to the European Commission, to the European Space Agency and to various European companies to develop Galileo systems and equipment for 10 years now.  Those contracts continue in force in many cases.  However, since the referendum two years ago it has become, first of all, informally difficult for British companies to win new contracts and in recent months it has become even formally the case that British companies do not get invited in some cases to bid for business that they would have been able to bid for prior to the referendum.

Q1634  Chair: In which cases are British companies being told, “You cannot bid”?

Patrick Norris: I do not have a list of cases, I am afraid, Chairman, because in a sense it is a self-fulfilling thing, in that if we do not get invited to bid then we do not get to know what we are not bidding for.  We have, if you like, ad hoc, anecdotal evidence.  If I may, the British Government would be a more comprehensive source of information, because they sit on a number of government delegate-level committees in Brussels, such as the Galileo programme committee, where they would in principle have access to comprehensive information about which companies are being prescribed.

Q1635  Chair: Presumably you are talking to the Government about that and sharing information with each other.

Patrick Norris: We do indeed, and we very much welcome the opportunity to talk to Government.  There has been a very intense dialogue over the past two years between Government and industry, but that is not to say that Government are able to give us information that they are not supposed to reveal.  I would not wish to claim the Government have told us everything.  That would presumably not be the case.  There is strong anecdotal evidence, and concrete cases from time to time, where we see that companies in other countries are winning business that we have not been invited to bid for, increasingly in the past few months.

Q1636  Chair: In other words, you find out after the event that the contract for X has gone to company Y, which in the past your member firms would have been expected to be invited to bid for.  Is that correct?

Patrick Norris: Yes, that is correct.  There have been such cases, yes.

Colin Paynter: Just to be specific about Airbus, because it is factual, we have been leading the ground control system for this programme for over 10 years, and that controls the full constellation of 26 satellites.  There is a round of competitive bids going on at the moment and one of the conditions in that bid documentation from the European Space Agency is that all work has to be led by an EU-based company from March 2019.  That is a condition of the tender process.  Effectively that means that for Airbus to bid and win that work we will effectively novate all of the work from the UK to our factories in France and Germany on day one of that contract.

Q1637  Chair: The transitional period is no use at all.

Colin Paynter: No, because this area of Galileo and many areas of Galileo are classed as a security-sensitive procurement, and that is not covered in the transition arrangements.

Chair: It is not covered.  It is useful to get that clarified. 

Q1638  Mr McFadden: I want to ask some questions about the money of Galileo and the alternatives.  I will start with you, Mr Norris, but your colleagues can come in.  First of all, clarify for us what the total budget for Galileo is.

Patrick Norris: The current multiannual financial framework has a budget of approximately €7 billion for Galileo, spread over the seven-year period.

Q1639  Mr McFadden: We have heard that the overall budget since 2005 is €12 billion to €14 billion.  Does that sound right?

Colin Paynter: That is approximately right.

Q1640  Mr McFadden: How much has the UK paid into that since 2005?  The Times this morning has quoted a figure of €356 million.  The FT says €1.4 billion, which is a very different figure.  Who do you think is right here—the Times or the Financial Times?

Colin Paynter: The UK takes part in these programmes relating to GDP, so we would expect somewhere between 12% and 14% of the total budget figure.  I guess somewhere between €1.3 billion and €1.4 billion, so more towards the FT, I would imagine, but I do not have the figures.

Q1641  Mr McFadden: I am sure the FT will be pleased with your answer, at least.  In the row that is currently happening we hear that the Secretary of State, Greg Clark, has said that the UK might have to withdraw from this completely, because of the conditions that are being imposed, and develop its own system. The Chairman referred to the contractual difficulties and so on.  How feasible is it for us, after more than 10 years of co-operation with this thing, to develop our own system?

Colin Paynter: The key thing for me is it is not up to industry to determine whether there is a requirement or need for an independent UK system.  We are a supplier.  I would say that in terms of feasibility, after such a long and deep involvement in the Galileo programme as UK industry, we have all of the skills and capabilities that are needed to support that programme should it come out.

Q1642  Mr McFadden: If there was a political decision to do so from the Government, the UK could do this.

Colin Paynter: Yes.

Dr Bowen: Technically, yes, it is feasible.  Britain could do it, but it will cost a lot of money and it will run over budget.

Mr McFadden: You anticipate my next question.

Dr Bowen: Yes.  You need to look at the other global navigation satellite systems that have been built.  The Americans are currently building their third generation of GPS satellites, and that is notorious for cost overruns and delays, because they are encountering new technological problems as they improve the system.  Britain has just built the satellites for the Galileo system.  That means Britain has to build a new satellite navigation system, not the same one, and that will mean new technological developments and innovations as well, which will cause delays. 

In terms of purpose, it is not a feasible option because we will probably have continued access to the GPS secure system and there are good reasons for Britain to remain within the PRS secure signal system with Galileo as well.  The question remains as to why Britain should have a fully independent one, given the cost, which we will also have to rely on other countries to launch into space for us as well.  There are larger questions on the degree of independence, because we will never have a completely independent space infrastructure. 

Q1643  Mr McFadden: We have some disagreement on feasibility here among you.  That is okay.  In the time I have left I want to explore this question of cost and timescale.  Let us assume that Mr Paynter is right that this is feasible.  If the Government made a political decision, “We are so fed up with these rows about access and contractual difficulties for companies that are based in the UK that we are going to do our own thing here”, how long would it take us and what would it cost?

Colin Paynter: We do not disagree in the sense that I think my colleague said it is technically feasible for us to do this.  Industry is not involved, whether it is a political decision or a requirement. That is very clear.  We support the Government’s line, which is plan A is to remain a full collaborative partner of Galileo, but plan B, if they wish to go down plan B—

Q1644  Mr McFadden: What is the cost and timescale of plan B?

Colin Paynter: It is difficult to give a cost at this stage.  It depends on the requirement.  My understanding is it is not to replicate the entire system.  It is to look at giving access to the UK for what is known as the public regulated signal, which is a higher reliability and secure signal, which can be used by blue light services or the armed forces.  It has certain anti-jamming characteristics and other things that you will need for those types of operations.  Given that we have stayed close to the Galileo solution, in terms of the numbers that have been quoted in the press, of £3 billion to £5 billion, I think it is the lower end, but that is not too far away from where we are.  We have learned a hell of a lot and have huge experience in the development.

Q1645  Mr McFadden: What about timescale?

Colin Paynter: It is difficult to say in terms of that.  Something like four to five years, maybe, given where we are.  There is much more of a production programme now.  Galileo was a huge time in development.  We have learned all those lessons now and we are able to benefit from that, so it is much less than 10 or 15 years.

Mr McFadden: You think £3 billion to £5 billion, and maybe four to five years. 

Colin Paynter: Yes.

Q1646  Mr McFadden: Mr Norris, do you concur with that, broadly speaking?

Patrick Norris: Yes, broadly speaking I do.  Could I just add that the Galileo public regulated service that Mr Paynter referred to is not yet available?  It is not yet complete.  Developments are continuing here in the UK and elsewhere.  Therefore, a question that might be asked is about when it will be available and whether an alternative British-only service would be available sooner or later than a Galileo public regulated service without the involvement of British Government and industry?  That is part of what Mr Clark is asking his taskforce to look at in the abstract British-only system.  Britain no longer being part of a Galileo public regulated service, which is not yet ready and which requires a lot of British industrial involvement in order to be ready, is the context in which the plan B, as Mr Paynter referred to it, is being looked at.

Q1647  Stephen Crabb: Can I ask Mr Paynter, first of all, and then the rest of the panel how reliant on UK technology the Galileo project is?

Colin Paynter: The matter of record is that the UK has been very good in the competitive process that has gone on in the last 10 years.  We talked about 12% to 14% of the budget from the UK.  Probably the UK has won more like 17% or 19% of the work.  We are very well placed on the ground control system.  We assemble and test the payloads in the UK and CGI does a huge amount of the security system.  We are at the heart of the Galileo project, but we should not be arrogant to say that those skills are not able to be replicated in the EU 27, because they are. 

Q1648  Stephen Crabb: That was my next question.  To what extent is there a unique competence?

Colin Paynter: There would be some delays as that other thing builds up, but I am sure there is competence there.

Q1649  Stephen Crabb: What about the use of overseas territories, like the Falkland Islands and Diego Garcia—the kinds of territories which perhaps other European countries do not have access to?  Is that a unique thing that we are bringing that makes the system work?

Dr Bowen: The French have many overseas territories as well.

Patrick Norris: I would not have seen that as a critical issue.  It is a cost driver to some extent.  There is a facility in the Falkland Islands and one in Ascension Island, but, as my colleague says, these could be replicated elsewhere.

Q1650  Stephen Crabb: If I could ask Mr Norris and Mr Paynter, we read also in the Times this morning that Ministers are looking at banning UK companies potentially from passing sensitive data to the EU if the EU goes ahead and bars UK involvement in Galileo.  What do you make of those kinds of suggestions?

Colin Paynter: I read it in the Times too, so it was news to me.  We have not been in any discussions around that.  I do not know whether it affects CGI more than Airbus.

Patrick Norris: I also read it and I have no particular comment to make.  I watch with interest.

Colin Paynter: UK companies will follow UK legislation and regulation, but I do not understand what it means at the moment.

Q1651  Stephen Crabb: I will just ask one more question.  In the discussions that you are having with people in your sectors, do any of you see a pragmatic way through this row?  Most people, when they read these reports in the papers, will not have the foggiest clue what this is all about, but you are very close to it in terms of the technology and the discussions going on with Government.  Can rational people like yourselves see a pragmatic way through all of this?

Colin Paynter: If I answer first, the European Commission is following its rules.  It believes it is following its governance principles and the UK will step outside and will have to enter a security arrangement, which is the rules.  We support the Secretary of State’s request for a pause in the procurement process to give us some time to discuss, or give the Government and the European Union some time to discuss this. 

As Airbus has said in the past, having us as part of the security arrangements by default during the transition period would help a lot and would give us a period of time that would allow the longer-term negotiation of defence and security arrangements to take place. It probably is in the discretion of the European Parliament to do that, because March 2019 is just tomorrow and that is the problem we are facing as industry on Galileo.  We have been caught in a timing trap.  If the renewal of the contracts were three years hence this would not be a problem, would it?  We are caught in this timing, so we are advocating that both parties work out a way of giving more time, and not removing us from the security principles until the end of transition would be a way of doing that, and would also be pragmatic, we hope.

Dr Bowen: The positions between the UK and the EU are reconcilable, especially in terms of access to the security-sensitive data and services from not just Galileo but also the Copernicus system as well, so it is observation and surveillance technologies.  Britain has to make the case to Brussels for that.  I agree that the EU is following its rules and policies, which Britain helped make when it was a member of the EU.  It is following those rules and procedures. 

There has been a lot of hyperbole in the media, and from many people in Westminster as well, about being shut out of European space or being shut out of Galileo.  It is not a ban and it is not a ban for life.  The way I interpret it is Brussels is saying, “Future access is subject to negotiation”, because it is as much in Brussels’ interests as Britain’s to keep Britain inside these services and these programmes, because Britain is very useful for European security and defence policies and capabilities.  Europe is increasingly funding more and more money to build a security capability, with security broadly defined.  It cannot do that significantly without Britain.  France has an interest in keeping Britain involved in those systems. 

Manufacturing components is another matter, but in terms of access to the services and contributing to the services Britain has as many reasons as Brussels to remain within that programme.  That is subject to negotiation and Britain has to make that positive case to Brussels, rather than make what is an unbelievable option of building a completely like‑for‑like system to Galileo, especially when you could spend £5 billion on other capability gaps in the British space sector and provide more useful capabilities that Brussels would find more useful, as opposed to duplicating what we have already built for Brussels over the last 20 years.

Q1652  Chair: It is interesting that you say, Dr Bowen, that the EU wants us to continue to participate.  I would just observe that it is a funny way of going about it.

Dr Bowen: They would have an interest.  I do not think they have stated that, but my hunch is they have as many interests to keep us in because of the wider defence and security politics going on.

Chair: It would be nice to see that expressed. 

Patrick Norris: I have a quick remark, if I may.  Let me just put my perspective on what it is that we are trying to protect here.  For the last 10 years, Government and industry have been investing in capability and skills that now are on the point of soon to be able to address a world export market for secure navigation services and systems.  We are not quite yet there.  That is what I tried to explain earlier. 

What we want is a way forward to address that world export market for secure navigation services, and there are two ways forward.  Our preferred option is to remain as part of the Galileo public regulated service community and to address the world market through that route.  That is what we have been invested in.  That would be the easy route, if you like. 

As has already been said, we have demonstrated a capability to have another route to the world export market, which is to have a more “go it alone” or “with other partners” type approach to address secure navigation services.  That might even, as I say, be before the Galileo version of those services is ready to be fully used. Either way, a way forward from the industry point of view is a way forward to gain a strong part of the world export market for secure navigation services.

Q1653  Emma Reynolds: In follow-up to the questions from my colleague Stephen Crabb, could you just say in more detail what the UK will be required to do by the European Commission in order to still have access to the public regulated service?

Dr Bowen: Since they have not said, I do not know. I do not know the *inaudible* [11:03:02] regulation in detail, but given that Britain is already a part of the Galileo programme, it is Britain’s choice by default to leave it through Brexit.  I do not foresee the need for any major, significant practical or on-the-ground physical changes to be made.  It would just be additional paperwork, I would imagine, but I do not know the *inaudible* regulations that well. 

Given Britain is already building those satellites, it already meets the security requirements, but this is uncharted territory for everyone involved.  It is an undiscovered country, if you will.  We really do not know exactly what will be coming, if and when Britain is going to remain a third party to Galileo.  Given that it is leaving its existing part in Galileo, I do not see there being too much of a regulatory challenge if the political will is there on both sides to keep Britain inside the service and data side of it.  Manufacturing and contracts is another debate.

Q1654  Emma Reynolds: The Commission has said that the UK as a third country cannot be granted access to sensitive EU-only information.  That seems to be the stumbling block.

Dr Bowen: America and Norway have requested access to the PRS system.  That is ongoing.  The EU is open to it because they are entertaining Norway and American access.  America, who opposed Galileo and tried to stop the EU from building Galileo back in 2003, now views Galileo as essential to its own security because it will become a backup to the GPS network.  It will become a part of military and intelligence infrastructure, with Copernicus as well, to NATO as well as the EU.  Because Britain is such a big European member of NATO, Brussels also has an interest in keeping Britain in as well, strategically speaking.

Q1655  Emma Reynolds: Some of the tough language we have seen from the European side might just be playing hardball in the negotiations, given that you think they have an interest in us continuing.

Dr Bowen: It is bureaucratically accurate language.  It sounds worse than it is, but that is my professional interpretation.  Since they are talking to the Americans and the Norwegians about access, there is every reason why they would talk to Britain about access.  Britain has good reasons to stay in, but it needs to make those reasons in a positive environment and in good faith to Britain rather than threatening the programme and threatening to make itself a pariah in the European Space Agency as well.

Patrick Norris: If I may just make a quick remark, let me just clarify that access to the Galileo secure services can be understood in several different ways.  The way that Norway, the United States, Israel and other countries are requesting access to it is that they will be able to buy equipment from the European Union and their armed forces or their security services will be allowed to use that equipment under certain rules and regulations.  They will, therefore, be able to get this secure service. 

The British Ministry of Defence has said that it also wishes to do that sort of thing.  It would expect to do so, but it has said that it wants to do more, if I understand it correctly.  You really should address such a question to them.  As I understand it, they would like not only to be allowed to use the service, but to have control over the equipment that they are required to use to get access to that service.  They need a sovereign capability to at least design and even better manufacture the equipment that the armed forces use for that service, rather than relying on equipment from some other country. 

It is because of that wish to not only use the secure service, but to control the equipment that is giving you access to the service that Britain is looking at something other than just emulating Norway.  A Norway or Swiss level of access would not be sufficient in principle for the UK, and incidentally I would imagine would not require the same level of funding that Britain has so far been contributing to Galileo.

Q1656  Wera Hobhouse: We can all say that a row like this is not helpful and starts to raise the temperature unnecessarily possibly, but it also demonstrates how all of this is mixed up.  Defence interests and economic interests are mixed up and this is probably the omelette that Pascal Lamy talked about previous in this Committee.  He said, “Brexit is trying to make an egg out of an omelette”.  Let us go back to the economic interests here.  Talking about the wider implications, how many UK-based companies have been involved in Galileo previously and would want to be involved in the future?

Patrick Norris: That is a good question.  There are a few dozen companies involved at different levels of the supply chain.  Perhaps three or four quite large companies, but a large number of small contracts, both small contracts for large companies but also contracts for SMEs.  I am aware of at least a couple of dozen companies all around Europe, in Scotland, in the north-east and in the midlands, as well as in the south-east, so it is quite an extensive industrial base, if you take into account the whole supply chain.

Q1657  Wera Hobhouse: It would have quite a big economic impact.

Patrick Norris: Yes.

Q1658  Wera Hobhouse: How many of those could move their base from the UK into a member state?

Colin Paynter: A lot of the big companies would be able to, so if we look at Airbus, for example, but also if you look at CGI, you look at QinetiQ or you look at some of the major primes.  They have sites in the EU 27.  From Airbus’s point of view, the bid for the next round of ground control systems went in on 24 April and effectively we have committed, if we should win that bid, to doing all of the work in the EU 27 at our sites in France and Germany.  That has made us slightly less competitive, because we are moving away from where the heritage is and where the skill is, which is in the UK.  A number of companies are in the process of moving that work, so that they comply to the conditions of the tenders.

Q1659  Wera Hobhouse: How much of the workforce can go with your company?

Colin Paynter: Not much, to be honest.  These are highly skilled people and if they wish to stay with the navigation they will move to France and Germany, but it is my job to reallocate them.  If those jobs are not applied to Galileo in the future, we will use those skills in other areas.  This is not about jobs lost per se.  It is about competence that is lost, because once you disperse a team like this it is very difficult then to reform them.

Patrick Norris: If I could just add, for the part of the Galileo work that has security classification, that is very difficult to move to another country because even if we move it to a subsidiary in another country we would need people with the competence and the local security classification in that other country to take on the work, and that is extremely difficult or almost impossible to achieve. Say in the UK, if we have 200 or so engineers, all security-cleared with British security classifications and who are British passport-holders, to say that we could move that work to another subsidiary in France, Germany or Holland and find people with the same skills and with the local security classifications is very difficult to imagine.  In the security area it becomes almost impossible to move the work.

Q1660  Wera Hobhouse: Can I just ask one question?  For example, you probably, particularly in the security sector, need approved suppliers and that application for becoming an improved supplier also takes time, does it not?

Patrick Norris: Absolutely. 

Q1661  Wera Hobhouse: If you had to change supply chains that would cause delays as well, would it not?

Patrick Norris: Yes.  If I understand the thrust of your question, this is indeed one of the reasons why the European Union would be motivated to keep the UK involved, because by having to change its suppliers throughout the supply chain it is likely to introduce delays and the more complex and sophisticated the area of work involved, the longer the delay for a new supplier to be able to step in and replace one.

Q1662  Wera Hobhouse: A more rational language about all of these issues would probably be a good thing, would it not?

Patrick Norris: One would like to think so, yes.

Q1663  Richard Graham: Mr Paynter, if I can start with you first, just to clarify what has happened so far, does the new instruction about tenders being limited to member states mean that those bids should be led by a registered entity in a member state or that all the work must be done within member states?

Colin Paynter: It is very difficult to pick and mix in this.  From our point of view, the most sensible thing to do is to do all of the work based out of a team in France or Germany rather than in Portsmouth, which is where our headquarters is now. 

Q1664  Richard Graham: That instruction on the tenders came from the European Union Commission, not from the ESA itself.

Colin Paynter: Our customer is the European Space Agency, but we understand that that is a procurement agency on the basis from the European Commission on Galileo, so it came down from its customer, if you like.

Q1665  Richard Graham: In terms, Mr Norris, of the ESA being an independent intergovernmental agency, am I right that it is entirely their decision who the members of the ESA are, i.e. if the US and Norway have applied, it is up to the ESA and not the European Commission as to who their members are?

Patrick Norris: That is not right.  For the Galileo public regulated service, the USA has applied to the European Union to have access to the service.

Q1666  Richard Graham: It would be the European Union.

Patrick Norris: Yes.  To get access to the Galileo secure service, other third party countries have to apply to the European Union.

Q1667  Richard Graham: In terms, Mr Norris, of your own employer, CGI, your involvement in the whole Galileo project is absolutely crucial.  Were the UK to decide to pursue our own independent project as an alternative to Galileo, presumably all the work that you have done, and indeed all the systems that you have developed, could be purchased by the UK for our own independent project.

Patrick Norris: That is a very good question.  I am not a lawyer, so I am afraid my answer will have to be only partial, in that the equipment and so on that we have developed for Galileo I believe belongs to the European Union, so in that sense we cannot just give it to somebody else.  Nevertheless, we have built up 10 years of experience and skills and we have learned a lot of lessons, as Mr Paynter said, which would be directly applicable to a UK system.

Q1668  Richard Graham: Under the changes of tenders that Mr Paynter was describing, how would CGI interact with a purely EU member state contract-led ESA for the Galileo project, because you are based in the UK?

Patrick Norris: As I think Mr Paynter explained, the European Space Agency is reflecting the European Commission rules.

Q1669  Richard Graham: Indeed, so how do you react to that?

Patrick Norris: I see.  We will try to take whatever action we can to win the business by using our subsidiaries in other countries, but unfortunately it is a very specialised domain.

Q1670  Richard Graham: The bulk of the work would still have to be done in the UK.

Patrick Norris: In the short term, the competence is certainly centred primarily in the UK.  We do have operations in other countries.

Q1671  Richard Graham: To be precise, could you continue with your current work on PRS without using your UK subsidiary?

Patrick Norris: I am not really authorised to give a black-and-white answer to that sort of question, but in broad terms it would be very difficult for us because of the security classification issue that I raised earlier.  Really our hands are tied.

Q1672  Richard Graham: In terms of what was decided in the meeting of the European Space Agency Council in Berlin on 25 April, did the UK block the approval of procurement for the next batch of Galileo satellites?

Colin Paynter: I do not know.

Patrick Norris: I do not know.

Dr Bowen: My understanding is that that vote was cancelled, partly because of the United Kingdom’s policy.

Q1673  Richard Graham: Is it not rather curious, Mr Paynter, that you do not know at Airbus whether that approval of procurement went ahead or not?  Is that not pretty critical to you?

Colin Paynter: The minutes of that meeting are not out yet.  It is a private meeting.  The industry is not involved in that meeting.  It is the Council members, so it is the 22 states of ESA.  I recognise from my colleague’s statement that it was removed from the agenda.

Q1674  Richard Graham: Dr Bowen, why was it removed from the agenda, in your understanding?

Dr Bowen: I cannot second-guess the UK’s thinking on this particular issue.

Richard Graham: It is the ESA that cancelled the meeting or took that particular item out of the agenda.

Dr Bowen: Possibly to avoid a vote going against its interests.  This is speculation.  You raise an interesting point about the relationship of the European Space Agency and the European Union.  The European Space Agency predates the European Union in its current form, but there is a large debate in my field about how independent ESA is from the European Union, given the importance of EU revenue to European Space Agency budgeting, so whether ESA is just becoming an implementing agency of the European Union and how the European Space Agency is very keen to take on more security and defence-related space projects for Brussels, to prevent the emergence of a rival EU space agency that would challenge ESA.

Q1675  Richard Graham: This is where it becomes interesting.  It would be unfair to ask Mr Paynter or Mr Norris political questions, but the question for you, Dr Bowen, is really this: everything we have heard directly from Michel Barnier suggests that he above all understands the importance of the closeness of the ongoing and future co-operation between the United Kingdom and the European Union, especially on defence and foreign policy issues. 

Therefore, when he talks about reaching a treaty that will bind the two of us together in closeness, it seems to some of us here very curious that while he is saying this on the one hand, we are getting announcements that clearly come from the European Union that threaten the closeness of that co-operation, set about encouraging the UK to create our own independent satellite system and go totally against the spirit of what he has been saying publically.  How do you explain that? 

Is it simply a left hand, right hand with elements of the European Commission doing things that Monsieur Barnier even now, even after reading the articles in the Times, is not aware of, is it a negotiating tactic to try to play hardball on the basis that the United Kingdom will come crawling along, desperate to remain in the Galileo project, or is it just incompetence?

Dr Bowen: I can understand how that looks and how that interpretation can be created from the way Barnier says one thing and it looks like there is not a lot of scope for agreement here, but the EU’s position here is entirely predictable.  The EU space industrial policy is quite clear on how industrial returns should work for the European military space defence industrial base.  When Britain decided to vote to leave, there was immediately the thought, “What is this going to do to British space?” because the EU space industrial policy is pretty clear on where EU-funded space project grants and manufacturing contracts should go.  It should go to European Union member states.  In many ways it is being quite bureaucratic and following set policies and rules, which Britain also helped build. 

Q1676  Richard Graham: Just to understand that, do you think they have not yet been able to make the link between understanding that if you are not going to give UK entities contracts in Galileo there is no point in the UK trying to continue within it, and therefore the logic of that would be to use our capabilities and expertise to create our own project, which will effectively be competitive?

Dr Bowen: Not necessarily.

Q1677  Richard Graham: They want to stimulate a competitor or they are just unaware that that is the likely consequence.

Dr Bowen: I do not see it like that.  The first response, I would have thought, to being allegedly shut out of Galileo is not to build a rival system, because it simply is too expensive to justify with Britain’s space budget size at the moment as well.  Also, it was an uphill battle to convince all of the European Union to put in the money to build a duplicate of GPS in many ways, but the EU managed to sell it on the commercial downstream applications and the autonomy gained from the Americans.

Q1678  Richard Graham: Can I just explore the logic of that with Mr Norris and Mr Paynter?  Let us assume hypothetically that the UK does decide to pursue its own strategy and you, Mr Norris, raised the interesting question earlier as to whether a British-led Galileo-type project would be completed potentially earlier than the European Galileo project.  In that situation who would the US most want to have as their backup for their own GPS system?

Patrick Norris: That is a very good question.  I could not really comment on that.

Q1679  Richard Graham: Presumably the technical answer would be whoever finished first and whichever project they had most confidence in, not least in terms of the intelligence and security aspects.

Patrick Norris: It is fairly logical to assume that if there was a competition in time between Galileo and a British-led secure service, whichever one finished first would have a better opportunity to win export orders.

Q1680  Richard Graham: Is that not the point, Dr Bowen?  Is that not the point?  If the EU have thought this through then the logic is, “They will create a competitor, which will have all its commercial interests in going hell for leather in completing this as quickly as possible and beating them on international contracts”.  This is a sector in which we have a competitive advantage.

Dr Bowen: Not necessarily, because when we talk about Britain building Galileo, it is a European project.  When you look at the components, all the manufacturing processes and the staff that goes into it, it is very much European.  It is not just British.

Richard Graham: You are saying that European providers of specific components would not wish to supply a British-led system.

Dr Bowen: The capabilities and competencies are distributed across the European defence industrial base and the space sector and the space economy, so I would caution against thinking we can really do all of it ourselves, especially when British companies are still being awarded only 15% of the work or so, give or take a few percent.  I really do not think that the EU wanted to stimulate Britain to do this, because I still do not believe it is a feasible or believable policy option for Britain to do.  Technically possibly, but economically, commercial and strategically the money can be better spent elsewhere.

As far as the Americans choosing a British system over the European one, the European system is almost up and running.  The British one is nowhere at the moment.  It will take many years until after the European system is up.  I am not sure how we can say that the British system will be up and running before the Europeans, especially when you have to take into account launch schedules.  We do not have our own launch systems.  We have to buy launch services from the Americans, the Europeans, or even the Indians and the Russians, or even the Chinese if you want to be a bit more adventurous, given security issues. 

There are a lot of scheduling issues, so I am really not sure that it is credible to think it will be either/or.  Even if there is a British system as well, Europe and America will want the British system to be at least compatible with those systems as well, so it is not a zero-sum equation either.

Q1681  Chair: Could you just explain, Dr Bowen, in terms of the export market and the ability to sell what Galileo has to offer?  Presumably if you leave on one side the Russian and the Chinese systems, which are GLONASS and BeiDou, presumably people are using GPS currently.  What is it that would make them buy from Galileo as opposed to GPS as it exists at the moment with its iterations you referred to earlier?

Dr Bowen: My understanding of Galileo’s unique selling point in the commercial sector is a better and more reliable commercial signal.  The current commercially and freely available GPS signal is quite vulnerable to jamming and spoofing.  If you have seen the film Tomorrow Never Dies, it is sort of like that.  It is relatively easy to jam the signal or spoof, sending the wrong data to receivers.  Forget about GoldenEye and all that; it is more Tomorrow Never Dies.  What the Galileo system is saying is you can get into this more reliable commercial system.  Commercial shipping will be more secure from very readily available GPS jammers.  Electronic warfare is a cat and mouse game.  That is what Galileo has been sold on.

Q1682  Chair: Whoever owns and controls whatever satellite positioning system there is in times of conflict could potentially deny that information to other countries or users.  That is correct.  From a strategic point of view presumably the UK thinks, “The Americans are unlikely to cut it off to us”, but other countries might think, “That may not be the case and, therefore, it would be better if we had our own system that we could run”, which no doubt explains why the Chinese and the Russians developed their own.

Dr Bowen: You are seeing that precisely, I believe, with India at the moment.  They are integrated with the Russian GLONASS system, which is their version of GPS.  They have an equal partnership status in developing the Russian global positioning system, or GLONASS, but they are also building a regional augmentation system based on GPS signals as well.  In time of crisis or war, the Indians are betting that in south Asia the Indian armed forces and other approved users will have access to precise signals in one way or another, either GPS or GLONASS. 

Some countries like to hedge their bets and think, “We will probably have access to either Galileo or GPS”.  One of the reasons America tried to stop Galileo in 2003 was that it was afraid that potential adversaries would have access to precision navigation signals, so that it could still use smart bombs or precision guided munitions that America could not switch off with its own GPS. 

Q1683  Chair: We are not thinking that Galileo would be denied in terms of the ability to use it would be denied to the UK, because if we want to buy it we can buy it, even though at the moment we look as though we are being excluded from its further development.

Dr Bowen: Yes, for the commercial systems.

Colin Paynter: There are two signals, Chair.  There is the open signal that everybody can use, just like GPS in my phone, et cetera.  Galileo is developed to be compatible with that, so that is a good thing.  We are talking about here access to the public regulated system, so the one that has anti-jamming features and the one that is more resilient and reliable.  You have to enter an arrangement with the EU, and I agree with my colleague: we do not know the terms of that arrangement yet to enable you to have access to that signal.  It is up to the EU and the UK to agree whether access to that PRS is available to the UK and at what cost.

Q1684  Craig Mackinlay: The GPS system is fascinating.  I have a 25-year-old unit and it works perfectly, which is a testament to the system.  It seems that this is a big countries’ big toy.  You have GLONASS Russia, the Compass/BeiDou Chinese system and the American GPS.  The spin-offs have been probably not foreseen when the Americans first put GPS up, where it is in my iPad, my iPhone and everything else.  We are increasingly reliant upon this for deliveries and for Uber, which I mentioned earlier.  All of these sorts of things were not anticipated. 

The autonomy, particularly in armed services, is the obvious one: that it cannot be turned off.  I remember when Princess Diana died that night GPS was turned off, because I was sailing down the North Sea and it was turned off.  I hear it was turned off because America felt it was a day of global potential uncertainty.  It is nice to have a backup. 

Is it really realistic that the Galileo system would trump the GPS system in terms of its economic civilian use?  I find that a little bit hard to believe.  The real question here is about whether UK industry has taken a role in the US GPS development and technology. They are putting up a few more to make the system more robust.  Are UK companies in that procurement process? Have we been crowded out by the US, or are we deemed to be a decent, reliable supplier of high-technology equipment?

Patrick Norris: If I may just give a partial answer at least, GPS has a military version of its signals.

Q1685  Craig Mackinlay: The UK has access to that.

Patrick Norris: The UK and NATO allies broadly speaking have access to that.  Others can be denied access to it.  That service is complicated and awkward to use, and the US is in the process of upgrading it with a new system, which has been slow to be deployed.

Craig Mackinlay: You could argue 15 years for Galileo thus far has been pretty slow.

Patrick Norris: Therefore, there is an interest, both in the US and other countries, in having a system that is secure, although perhaps not quite as secure as the GPS military version, but is at least easier to use and is not as complicated for forces in the field to use or for non-military people to use.  The Galileo secure service has emerged partially in response to that perception.  There is an unfilled demand, both from military services and from other security users, to have something that is better than the GPS that you have in your phone or in your in-car system, but is perhaps not as complicated, secure, expensive and awkward to use as the fully fledged military version. 

There is a range of possible ways to address that market, if I can call it that.  The Galileo public regulated service is one attempt that Britain is currently involved in to try to address that market, but there could be other ways to do it, which is why there is really an opportunity for Britain to learn the lesson from Galileo, which as you rightly say has taken quite a long time to come to fruition.  In that time technology has changed and, therefore, perhaps there is an opportunity to leapfrog.

Craig Mackinlay: The question was whether UK companies have taken part in GPS.

Patrick Norris: Sorry.  Thank you.  I beg your pardon.  Yes, at the moment there is at least a small programme where British companies, such as QinetiQ, are developing receivers that will work with the new military version of the GPS service.

Q1686  Craig Mackinlay: Have we put components in the satellites?

Patrick Norris: In the satellites, no.

Colin Paynter: No.  They started out a long time ago as US military satellites, because it was the Pentagon that originally funded the GPS system.  No, certainly not UK companies, or European—

Q1687  Craig Mackinlay: On a technical point, just to help me with my understanding of these systems, is it proposed that in the future my iPhone will be picking up both Galileo and GPS at the same time?  Will that need upgrading to do it?  It will just pick it up.

Dr Bowen: It is already talking to GLONASS as well as GPS right now.

Q1688  Craig Mackinlay: That is picking up the Russian free system as well.

Dr Bowen: The Russians have a free signal as well.

Q1689  Craig Mackinlay: Will the Huawei phone of 2021 be picking up the Chinese one as well?

Dr Bowen: Possibly.

Q1690  Chair: I just have a final question.  What does all of this uncertainty about the future mean for the UK space industry?

Patrick Norris: It is certainly an extra risk that was not foreseen a few years ago.  The industry and the Government jointly produced a strategy for the future, in which we hope to achieve a 10% share of the world market by 2030.  Brexit has raised question marks and is forcing us to reconsider how to achieve that objective.  It is diverting attention away from, if you like, core business. 

Q1691  Richard Graham: Is your view that the best way for the UK to achieve that strategic goal now is to try to reach reconciliation with the EU about our future involvement in Galileo or to say, “There is enough uncertainty about the direction the EU really wants to travel in with us outside the EU for us to need to make a strategic decision of our own to pursue an independent strategy and, if need be, to take them on and develop a competitive advantage”?

Patrick Norris: At the moment the industry view is that we support the Government in continuing to try to negotiate full involvement in Galileo.

Q1692  Richard Graham: What if that proves not possible?

Patrick Norris: Should that prove not possible, yes, then we would follow the Government in trying to find an alternative that still helps to achieve the strategic objectives of the industry.

Chair: That is very clear.  Thank you very much indeed on behalf of the Committee for coming today and giving such really helpful evidence.  That concludes the proceedings.