International Trade Committee
Oral evidence: UK trade negotiations: Agreement with Australia, HC 1002
Wednesday 9 March 2022
Ordered by the House of Commons to be published on 9 March 2022.
Members present: Mark Garnier (in the Chair); Paul Girvan; Sir Mark Hendrick; Tony Lloyd; Anthony Mangnall; Mark Menzies; Lloyd Russell-Moyle; Martin Vickers; Mick Whitley; Mike Wood.
In the absence of the Chair, Mark Garnier was called to the Chair.
Questions 106 - 138
Witnesses
I: Swee Leng Harris, Director, Strategy & Litigation, Luminate; Eunice Lim, Senior Manager, Policy – Asia-Pacific, BSA | The Software Alliance; and Sabina Ciofu, Head of EU and Trade Policy, techUK.
Witnesses: Swee Leng Harris, Eunice Lim and Sabina Ciofu.
[This evidence was taken by video conference]
Q106 Chair: A very good morning to everybody for this morning’s evidence session, which is the third evidence session of the International Trade Committee sub-inquiry into the UK-Australia Free Trade Agreement, which was signed in December 2021.
This session will feature two panels. The first panel will be on the digital trade chapter, and the second panel will look at both competition policy and consumer protection provisions and Government procurement.
Perhaps I could start with some quick introductions from each of the panellists. Swee Leng, would you like to start?
Swee Leng Harris: Hi, Committee. Thank you very much for inviting me to give evidence. I am the Director of Strategy & Litigation at Luminate, which is a global philanthropic organisation. I am also a visiting senior research fellow at the Policy Institute, at King’s College London, and I am a member of the UK Government’s Privacy and Consumer Advisory Group.
Eunice Lim: Good morning, Chair, and members of the Committee. I am the Senior Manager, Policy for the Asia-Pacific region at BSA | The Software Alliance. BSA represents the global enterprise software industry and our members include Adobe, Cisco, SAP and many other leading software companies in the UK and worldwide.
Two years ago, BSA launched an initiative called the Global Data Alliance, in which we brought together companies from different sectors who all rely on international data transfers and are committed to high standards of data responsibility. I lead the Global Data Alliance work in Asia-Pacific. I appreciate the opportunity to participate in today’s hearing and look forward to our discussion.
Sabina Ciofu: I am Associate Director for International at techUK. I cover our international trade and international policy programmes. It is great to be here again.
Q107 Chair: Thank you very much. Swee Leng, perhaps if I can start with you and ask you a very simple question: how are businesses going to see the difference once this free trade deal comes into force? What are the material differences for business when it comes to digital trade and how are the digital trade provisions going to make life easier for them on both sides?
Swee Leng Harris: If I may, I might defer to my fellow panellists, who have greater expertise in terms of business interests. I will tackle questions more focused on data protection and individual rights, if that is okay with you.
Chair: Who would like to have a crack at that? Sabina?
Sabina Ciofu: I am very happy to. Thank you very much. It is going to be important to note that this is the first agreement negotiated from scratch, so the difference to business will be immediate. Unlike agreements with Japan and others, this is not an improvement on an existing baseline agreement but a brand new one with a country that we have not had an FTA with before. I think businesses will find it easy to do business as soon as this agreement enters into force. They will be able to access the Australian market with greater certainty. Companies and individuals will also be able to benefit from the business mobility terms that I think will facilitate servicing client projects in the market.
However, I think the more apparent, or more substantial, benefits will come over time and will depend on the continued commitment of both sides to develop the provisions further. While we have a pretty good digital trade chapter—I would argue that it is probably a gold standard globally in the level of commitments—the real value of this trade agreement will come from elements of the regulatory co-operation in tech regulation and the use of the strategic innovation dialogue. Making sure that domestic regulators are fully involved in these mechanisms and that there is strategic engagement with stakeholders and broader society will be key for reaping the full benefits of the agreement.
I think there will be immediate ease of business but longer-term benefits as much as the two Governments commit to progressing it further.
Q108 Chair: Could you give an example? If you are a business engaging in digital trade with Australia from the UK now, what is hindering you at the moment and what is going to change? It would be very helpful for us to have an example of how that would change.
Sabina Ciofu: In the absence of a trade agreement, there are multiple market barriers whether it is things to do with data flows, which obviously are key to a digital trade chapter, or things to do with mobility, visas, entry of personnel into a country, procurement—in all these areas, without a trade agreement you would have a much harder job doing business in the market. While it may be less of a problem for multinationals that operate across the globe and have the right resources to deal with compliance and everything that entails, it is a very difficult scenario for a small company. The FTA puts certainty in place for how you are going to be able to operate there. That is the main difference between having an FTA and not having an FTA.
Q109 Anthony Mangnall: Sabina, can I keep you online on this? You said that this is an opportunity to see how digital trade can evolve and develop. I am interested in where and how it might develop and where we might expect to see free trade agreements expand in this area.
Sabina Ciofu: Digital trade is one of those fields that require constant commitment and dialogue, because technology evolves so fast. What I mean by that is that in the FTA we have commitments for regulatory co-operation and commitments in the innovation chapter for the strategic innovation mechanism, which is fantastic; they are great. They provide exactly that—the opportunity to keep up to date with what is happening in the market and to make out of a trade agreement a living document that goes with the times.
To be more specific, there are issues such as co-operation on digital ID, co-operation on emerging technologies, things that we know about and things that we don’t know about yet that may come in the future. There are things like the strategic innovation dialogue in the innovation chapter, which provides the opportunity for industry on both sides to come together and create the innovation partnerships that are so important for industry, academia and research. There are multiple opportunities here. It is just that we will need to look at the implementation phase: how to bring our regulators together, how to bring our industries together, how do we keep consulting with broader society as we develop mechanisms to keep the document alive, if that makes sense.
Q110 Anthony Mangnall: It certainly does. Thank you very much. I am going to bring Eunice in now too but, Sabina, you mentioned that this was almost a gold standard in terms of an agreement. I hope I am not misquoting you. Eunice, do you agree with that? How unique and groundbreaking is this agreement in terms of digital trade? I know my colleagues have further questions on this, but I will start with that.
Eunice Lim: Yes, I agree with Sabina that this agreement sets a new gold standard in digital trade agreements or digital trade chapters in FTAs. It speaks to the accelerated pace of digitalisation in the last two years, which means that, across every sector of the economy, companies are now more reliant on digital technologies than before to conduct economic activities and support job creation in the digital economy.
What is groundbreaking here is that there is a concerning trend where we see certain countries moving towards digital protectionism. The forward-looking digital trade rules in the agreement will support innovation, productivity growth and overall competitiveness in the digital economy.
There are three notable areas in the UK-Australia FTA that I would like to highlight. They may not be limited to the digital trade chapter but, first, the digital trade chapter—I think Sabina has spoken about some of them earlier—includes strong provisions on cross-border data transfers, data localisation, custom duties on electronic transmissions, source code encryption, server security and personal data protection.
The FTA also includes new commitments not seen in the CPTPP, which was previously cited as the gold standard for e-commerce chapters, things like digital identities, data innovation, open government data, e-invoicing and e-contracts. These provisions show that UK and Australia are leaders in setting new digital trade rules and send important signals that both countries support a rules-based international trade economic system that advocates for free, fair and open trade.
The second chapter I would like to point out is the financial services chapter, which contains provisions prohibiting cross-border data transfer restrictions and data localisation requirements for financial services data. These provisions are examples of what we think are global best practices, which will help ensure that financial services in the UK are protected from unnecessary or discriminatory data transfer restrictions or data localisation requirements. This will continue to support the financial services sector in the UK as it leverages digital technology for growth.
Lastly, and I think Sabina spoke about this earlier too, the innovation chapter is the first of its kind in any FTA. It is significant because innovation underpins the growth of the digital economy and provides the mechanism for the UK and Australia to discuss the impact of innovation on trade. It includes provisions on regulatory approaches that will support the development of interoperable frameworks and promote bilateral co-operation on emerging technologies. This will make sure that the agreement will continue to remain the focus. I will stop here now.
Q111 Anthony Mangnall: Thank you very much. That was a very comprehensive answer. I don’t want to step on Mr Vickers’ territory of CPTPP, but this agreement is unique in the sense that you are saying that we are going beyond a lot of the other agreements in principle. Will that translate further afield to other countries adopting what we have done in the UK-Australia trade agreement?
Eunice Lim: We certainly hope to see that being replicated in other trade agreements that the UK is signing or other more likeminded trading partners are committing to. This is something that we see as a positive trend, and we hope to see it continue.
Q112 Martin Vickers: Thank you, Eunice. To develop further and make comparisons with CPTPP, how do the digital trade provisions in this agreement compare with their equivalents in CPTPP?
Eunice Lim: As I said earlier, we have seen upgrades in the provisions of the agreement, in terms of not only breadth but also depth, and there are now new commitments in new areas, such as digital identities, e-invoicing, data innovation, e-contracts, which speak to the development of the digital economy and digital trade. We have also seen existing obligations being enhanced, with higher benchmarks set.
I would like to take the example of cross-border data provisions. In the agreement, they are drafted in a more rigorous manner than in the CPTPP as they prohibit data-transfer restrictions and localisation mandates. CPTPP merely requires a party to permit cross-border data transfers and this is a less legally effective drafting convention.
Another thing—I spoke of it earlier—is also that the agreement contains prohibitions against localisation requirements for financial services data. We are of the view that rules specific to any sector must be substantially the same as the rules of general applicability on cross-border data transfer and localisation.
Q113 Martin Vickers: To use the phrase from earlier, it is a gold standard? Would you describe it as a gold standard?
Eunice Lim: Yes, it is definitely a gold standard FTA.
Q114 Anthony Mangnall: If I may, and on the back of Mr Vickers’ point about CPTPP, where does the digital partnership between the UK and Singapore fit in on this? Is it a comparison with Australia or a comparison with CPTPP in terms of the terms of digital trade, or is it too early to say that?
Eunice Lim: I think it is too early. We know that the UK has recently concluded and signed a digital economy agreement with Singapore, but I believe that the text is not publicly available yet. However, seeing the two agreements that we have seen the text of—the Singapore-Australia DEA and the UK-Australia FTA—we are very hopeful that the strong digital trade provisions will continue in these new trade agreements.
Q115 Anthony Mangnall: One follow-up, if I may. I think the text on the New Zealand deal is out. Are the digital provisions in the New Zealand agreement the same as in the Australia agreement? My apologies; I have not got around to reading the New Zealand agreement yet.
Eunice Lim: Do you mean the UK-New Zealand agreement?
Q116 Anthony Mangnall: Have we used the same provisions in the New Zealand agreement as we have in the UK-Australia trade agreement?
Eunice Lim: I think they are pretty similar, but I must admit that I have not taken a very close look at the text of the UK-New Zealand FTA.
Q117 Anthony Mangnall: Sabina, you are nodding. Do you want to make a comment on that?
Sabina Ciofu: Yes. I think we are seeing similar language in the UK-New Zealand and UK-Australia agreements and the UK-Singapore digital economy partnership. I think that is a step up from the previous agreements between the Pacific countries themselves. We have an Australia-Singapore digital economy agreement and a New Zealand-Singapore-Chile one, which is a digital economy partnership agreement. I think we can confidently say that what the UK has put on the table in its agreements with these countries is a step up from those agreements that were the gold standard until a couple of months ago, and they are from 2020.
Therefore, from the summer of 2020 to now, I think we can confidently say that the UK agreements signed with these countries are the current gold standards for digital trade, because they go further in the realm of regulatory co-operation. They deal with the kinds of things that you can do, talk about and advance in partnership with likeminded countries. I definitely think it is part of the strategy that we knew, but it is has very similar language to the other countries. Singapore is negotiating a digital agreement with Korea as well, so we will have to see if that becomes the new gold standard when that is done, but for the time being I think we can confidently say that what we have on the table is the best trade provisions globally.
Q118 Anthony Mangnall: I am interested in the process of how this is evolving, because we started with Japan and we evolved our rollover deal to include digital terms. Are you seeing a general progression, and do you also have an expectation that CPTPP is going to catch up with us now that we have signed this agreement with Australia? That is an open question to whoever wants to answer it.
Sabina Ciofu: Very briefly, CPTPP, like any agreement that involves more than two countries, is going to be more difficult to upgrade than what you can achieve between two like-minded partners.
An agreement with Singapore on digital provisions is probably the easiest one to get right. As soon as you get more countries around the table, with different systems and different understandings of trade policies and capacities at home to deal with all these questions that are fairly new and innovative, it is difficult.
CPTPP, even if you do upgrade it in the future, is unlikely to ever reach the level of ambition that we are able to see between Australia, New Zealand and Singapore of what the UK has agreed with all of them simply because of just the range and differences among the negotiators.
However, CPTPP is the baseline. It shows that basically all the members of CPTPP, which have been building on that agreement and have created bilateral and regional agreements among themselves, have all started from that baseline. It is an important group of countries to be part of.
Q119 Anthony Mangnall: The point is we have done bilateral agreements with Japan, and now Singapore, Australia and New Zealand, presumably with the same provisions. If all the CPTPP members have agreed on these provisions individually, why wouldn’t they include that in CPTPP in general?
Sabina Ciofu: I will let Eunice come in if she wants to. I tend to agree, but CPTPP is more than that. There is a group of really advanced countries in digital trade, but it is not only them. You will have other countries broadly negotiating in those conversations then bilaterally. We do have the leading nations in digital trade in that group, but it is a broader group.
Eunice Lim: The new gold standard has quite a number of new provisions that we have not seen in other FTAs before. We have seen them in digital economy agreements, but we have not seen them in free trade agreements. To incorporate some of these into a CPTPP class or an upgrade of CPTPP would definitely take a lot of effort. To Sabina’s point, CPTPP does include members who are at a more nascent stage of regulatory development, so I think that would be a challenge for them. I believe that the challenge for CPTPP at the moment is to assess new countries that are interested in joining CPTPP and to assess whether these countries’ regulatory approaches would be in line with the CPTPP agreement. It would take a while for them to catch up to these new standards.
Q120 Paul Girvan: Thank you. This is to Sabina and to Eunice. Are there any aspects of digital trade on which your members feel the agreement should have liberalised further, Sabina?
Sabina Ciofu: I will be very brief here. Generally speaking, they have done an exceptional job. Even in terms of setting up the objectives and meeting those objectives for the negotiation, I think they have delivered an incredible digital trade chapter and innovation chapter, so there is nothing to add from me.
On the further provisions around procurement and opening up procurement contracts, not only at national level, on mobility and the mutual recognition of qualifications, all of that, I cannot think of anything else they should have done.
Eunice Lim: We do think that there might still be a little bit of room for improvement, especially when it comes to the cross-border transfer provisions, but we are generally very happy with the way it extended it. We do think that the provisions text is a little less vigorous than the US-Mexico-Canada agreement and the US-Japan digital trade agreement, because the provisions that are there do not incorporate the necessity text requirements, neither does the UK’s Australia FTA prohibit discrimination between domestic and cross-border data transfers. Therefore, there is still room to improve the text, but generally we think the text is very good.
Q121 Chair: When you say “improve the text”, presumably, a free trade agreement is a done deal, so how do you improve the text? Do you do it through subsequent agreement, or are you suggesting we improve the text on future trade deals?
Eunice Lim: You could consider that for future trade deals, but within the FTA there are also review mechanisms available. For some of the FTAs it is every two years, or every five years, so depending on when the review mechanism is for the UK-Australia FTA that could be something that can be taken into consideration upon review.
Q122 Chair: We have never done any trade deals before. This is the first one we have done ab initio. Do you think this sets a good benchmark, in terms of the areas we are looking at, by which we can judge future trade deals against this one as to whether they are good, bad or indifferent? Sabina, you said that this is as good as it can possibly get. Are you essentially saying that, from now on, we can be happy that if a trade deal is better than this it is a brilliant trade deal in terms of digital trade, and this is where it is a good benchmark?
Sabina Ciofu: This concerns the future, as there will be a number of issues that will keep coming up that we may not be aware of now. Future trade deals will probably build on this as technology develops, as we have potentially new issues in markets or because of new or emerging technologies that we had not thought about at the time of signing this one.
We cannot really say what may happen with future trade deals. What I think is good is if this becomes a benchmark for how the UK negotiates its own trade deals. We have Canada-Mexico coming up and renegotiation of the rollover agreement—so for those to have a similar digital trade chapter and an innovation chapter, all the things that we have seen here. If we can aim for similar approaches with these partners I think that would be great.
We are also facing more difficult negotiations moving forward, as we are moving away from the very like-minded countries to slightly more complicated partners where the level of ambition will have to be managed to a certain extent simply because those countries, or our partners, will not have a similar view of trade policy as we do.
We are looking at potentially more challenging negotiations going ahead, and those were not necessarily easy ones but the ones where we agreed on pretty much everything with our trading partners. It is difficult to say how this will play out, but generally, if we can use this as a benchmark, that is a good way to go.
Eunice Lim: I would just add, I think there is a real opportunity here for this FTA to serve as a reference model for other agreements and to help build global consensus on new additional trade deals.
I think the Chair had asked how this would evolve in future. I could share my experience, having worked on data protection policies in Singapore and having led negotiations in previous FTAs that Singapore has participated in. When we first started devising text for the data protection article, there was very little we could move beyond saying that each party should recognise the need for a regulatory framework that protects personal data and privacy of citizens or users.
As new regulatory systems in regimes became more mature, we realised that additional text could be added in—things that you could see in the FTA itself. There is text referencing important principles of privacy, and this is a step up because you are getting two like-minded countries recognising common principles in data protection. Then you have the UK and Australia recognising that, despite having different regulatory approaches, they would work on compatible mechanisms to enhance interoperability. There is always room to improve the text, but as technology improves we will see what room there is to improve the text.
Chair: Quite a challenge because you are dealing with a very dynamic area. Interesting. Mick Whitley.
Q123 Mick Whitley: Good morning to all the witnesses. My question is to Swee Leng. How well does this agreement balance the liberalisation of digital trade with protecting data rights of citizens?
Swee Leng Harris: Thank you very much for that question. I would make three observations in relation to this agreement and the broader context for it. The first is that there are a number of provisions that I think are good in the text. Notably, as an Australian and a British citizen, I am very pleased to see Article 14.12, which relates to personal information protection. We can see here the parties encouraging each other to have and maintain strong data protection standards. From that perspective, the rights of citizens are certainly a goal that is being upheld in the agreement.
I also note that Article 14.10, in relation to cross-border transfer of information by electronic means, includes a very important exception, or carve-out, to the general principle of freedom of data transfer, which is that laws are allowed for legitimate public policy objectives. The crafting of that provision clearly shows an intent by the parties to balance the free flow of data with protection of citizens’ rights.
That being said, my second point would be that there are risks in this agreement, most notably again Article 14.10. Because of this general principle of the free flow of data, including personal data, there is a risk that one or another party could challenge in a trade dispute the laws of the other party. For example, Australia could conceivably challenge the UK GDPR, so called—the UK laws that protect citizens’ rights and interests in relation to their personal data.
This is not something that is highlighted in the Government’s impact report on the agreement. I imagine that is because a free trade agreement is much like a marriage, you are not thinking about divorce and dispute when you start off on the path. We are all very happy that we have signed it and we are hoping for good relationships into the future. The reality is that these agreements do come with these kinds of legal risks, and that is one that I think is worth highlighting to the Committee.
The third point that I would make is that this agreement needs to be understood in the broader context of UK law and Government policy. There are two regimes now governing digital trade and the cross-border flows of personal data. One is the trade agreements that this Committee is carefully scrutinising. The other is the UK GDPR data protection laws. The interplay between these two regimes can be quite complicated but is important to understand.
When we look at this agreement in the context of broader UK Government policy, in the UK Government’s consultation paper in relation to the future of data policy in the UK, “Data: a new direction”—that was a consultation that happened at the close of last year—we see that the Government have indicated an intention to lower the standards and protections that the UK requires for international transfers of data. That is just in consultation and has not yet been translated into law, but it is an important indication of the direction of travel of this UK Government.
I similarly note that the DCMS guidance on international data transfers has identified a number of priority destinations for UK adequacy determinations, as this Committee probably knows but I will rehearse just in case. What is an adequacy determination? One of the ways that the UK GDPR allows personal data to be freely transmitted across borders is if there is an adequacy determination by the UK. The significance of it is that the UK Government determine that the other party has data protection laws that are equivalent to the UK’s high standards.
If the UK does proceed with making an adequacy determination for Australia, the risk is that such a determination will not be consistent with the EU’s GDPR regulation and, therefore, the UK could lose its adequacy from the EU. David Davis described Brexit as three-dimensional chess, but this is at least three-dimensional if not four because you need to pay attention to data protection regulation, trade law and the relationship between the UK and Australia, but also the relationship between the UK and the EU.
I will close by saying that there are good reasons why the UK ought not to provide an adequacy determination with respect to Australia unless Australia’s laws change. That is because the Australian Privacy Act does not apply to small business. It does not apply to employee data. It does not apply to political parties, among others. You can see from those carveouts or exceptions that it does not have the same comprehensive nature of the UK GDPR that, as many describe, is a gold standard in data protection. Those are the three points that I would make about the agreement.
Q124 Mick Whitley: You mentioned Article 14.12. They are not gold standard in that context?
Swee Leng Harris: Is Article 14.12 the gold standard? It depends on gold standard for what? It is great to see it in the agreement. It definitely indicates an intent, but it could be rendered mute if one of the parties has entered into a free trade agreement with another country that does not have the same protections that are provided in Article 14.10, because that other country could challenge the data protection laws of either of the parties to this agreement and Article 14.12 would serve as no defence to that challenge.
Q125 Mick Whitley: I have a supplementary question to Sabina and Eunice. How do your members view the agreement’s provision on data privacy, Sabina?
Sabina Ciofu: I think we have strong language on privacy for our trade agreements. I would also disagree with the previous speaker that trade agreements have some data protection, as they do not. It is the UK future regime that we do not yet have a full understanding of. We have some indication of what it might look like based on the Government consultation last year, and we are expecting a Government response to the consultation responses. We are making suppositions about what might be in there and what won’t be in there, while they are assessing the consultation responses. We have seen some good things in the consultation and some things that we are worried about, as with any kind of new law that is being put forward.
It will be the UK GDPR that governs how international data transfers for personal data are happening. The risk that Australia would challenge us somehow for breaking the Article on data flows is actually covered by that exception: that you are allowed as a country to make your laws for legitimate public interest and privacy has always been a legitimate public interest.
Therefore, I think we have very strong language for privacy in that agreement. I do not think that the agreement covers how we are going to transfer personal data between the UK and Australia. That will be a matter for whatever future assessment the UK makes on Australia’s privacy law, and whether it does or doesn’t grant adequacy. Other than that, we can use other mechanisms available to transfer personal data to Australia, SCCs and others that allow you to do that in a legal manner, but it is not the trade agreement that basically allows personal data to travel anywhere. It is those mechanisms, whether it is adequacy or SCCs or BCRs or other mechanisms for transferring data. I just wanted to add that.
I think the agreement does a good job of balancing data flows, which is so important for the industry and for the protection of personal data. There are commitments in there to work on that and a set of principles for how the privacy regime should look. It is not the agreement that would decide what kind of personal data travels to Australia. Eunice may want to add something to that.
Eunice Lim: Yes. I agree that, beyond just an adequacy determination, there are other mechanisms that will allow for data to be transferred. Therefore, we do not have to be too preoccupied with the adequacy determination and whether the UK will be granting adequacy determinations to other countries.
For our members, we are generally very supportive of the data privacy provisions in the digital trade chapter. What we see as being most encouraging is that both parties have committed to enhancement of operability. That is key for global entities that are based in different jurisdictions. Like I said earlier, while they recognise that parties may take different regulatory approaches, they want to commit to working on mechanisms that can promote compatibility and, hopefully, one of these mechanisms could be on data transfers.
Q126 Anthony Mangnall: I want to understand about the protection provisions that are in it, and whether or not they are comprehensive enough. The second bit is that you mentioned this point about Australia having lower standards when it comes to protections for citizens. Is there a case that our higher standards will help encourage them to update and modernise their standards to meet ours?
Clearly, there is a risk—as you have just outlined—that if we go and sign free trade agreements with other countries merry hell could be played if we do not have harmonisation across all the other trade deals that we have.
Swee Leng Harris: It is certainly my personal as well as professional hope that the efforts reflected in this agreement do export the high standards of UK data protection to Australia, and that is one possible way it would play out.
The point I was making is that, unfortunately, it is not the only way that it might play out and if the UK, in too much haste, signs agreements and provides adequacy decisions for countries that do not have comparable levels of protection, that will weaken the protections that UK citizens enjoy, because once data about us is transferred to those other countries then the lower standards will be what is governing and failing to protect the data.
I would just add, and respectfully disagree with my fellow panellist, Sabina, that Article 14.10, paragraph 2, refers to personal information as specifically information that is governed by that provision, so unfortunately I don’t think it is the case that this agreement covers only non-personal data. I think that personal data is not only implicitly but explicitly covered by the provisions in 14.10.
Sabina Ciofu: Yes, I fully agree that the data flow provisions in the trade agreement cover all kinds of data, it is just that the data protection is up to UK law. The UK standard of data protection will continue to apply. That means that the Government mechanism for how that data is transferred and processed and taken care of is the UK GDPR. That is what I said; it is not that the trade agreement does not cover personal data. It covers all kinds of data.
Q127 Anthony Mangnall: This might be an unfair question—please feel free to ignore it—but which countries should we be worried about doing digital agreements with—countries that do not have adequacy and an agreement may cause trouble with other free trade agreements? Should we also be worried that we do not have the text on an agreement that has been signed with Singapore on digital partnership?
Swee Leng Harris: I am going to slightly side-step that question, and instead—
Anthony Mangnall: You should be a politician.
Swee Leng Harris: —focus on the US. This is not a political point about the US at all. It is a legal point. Something that has happened repeatedly in the last few years is that the Court of Justice of the EU has struck down the agreement between the EU and the US for essentially data adequacy. This was originally the Safe Harbour laws and more recently the Privacy Shield. These decisions are known as the Schrems decisions because the litigant was Max Schrems.
I mention this because, if the UK enters a free trade agreement with the US, and if as part of the UK’s broader international data policy the UK Government give an adequacy determination to the US, that would place the UK’s position of the UK GDPR and data protection provisions in direct conflict with the current situation for the EU and the US. At that point, it places in jeopardy the UK’s adequacy from the EU because the EU will be concerned that personal data about EU citizens might go from the EU to the UK and then from the UK to the US.
Anthony Mangnall: Thank you. Well side-stepped.
Q128 Mike Wood: Building on this, clearly this agreement does not exist in isolation. How do you see the data protection provisions contained in this agreement as being likely to interact with equivalent provisions in other agreements to which the UK and Australia either are, or may become, parties? The obvious example being CPTPP—TP; too many Ps.
Swee Leng Harris: Yes, it is rather the alphabet soup. I would say that the data protection provisions of the trade agreement really signal intent and recognition rather than establishing new rights because, as Sabina has rightly pointed out, it is the UK GDPR that is really embodying and governing the data protection laws in the UK.
These provisions, especially Article 14.12, might be rendered moot and ineffective if there are other agreements with lower standards. Because it means that third countries might challenge Australia regarding, say, the CPTPP, and have a chilling effect on Australia raising its standards. Therefore, Governments will rightly and rationally think twice before passing new laws and improving their data protection standards if they think there is a risk from other agreements that those laws could be challenged. Even if the challenge is not successful, because the legal argument to challenge the laws is not strong, the reality of trade disputes is that they create uncertainty both for Governments and for citizens and companies and they are very expensive. They take an enormous amount of resource, even if the challenge is ultimately unsuccessful.
Q129 Mike Wood: Eunice, from an industry point of view, do you have any thoughts on how those would interact?
Eunice Lim: Generally, we think that the agreement’s provisions were built upon advanced components from other agreements, such as CPTPP. We do not see any conflict between complying with the CPTPP and the agreement. We do think that the agreement’s stronger language provides greater certainty between parties and the businesses.
Q130 Mark Wood: If we are looking at why perhaps it was not an issue when the EU was putting together what became GDPR, presumably it would be down to the fact that digital and data chapters in international trade agreements were not such a feature at that time. Would that be correct?
Swee Leng Harris: I am not an expert on EU trade policy, but my understanding is that they tended not to include digital trade in their trade agreements and instead allowed the GDPR to govern the cross-border data transfers.
Q131 Anthony Mangnall: Are you saying that countries are slower in introducing domestic digital trade rules because they fear that if they sign free trade agreements it would have an impact and their own domestic rules would be challenged?
Swee Leng Harris: Yes. There is a generally recognised phenomenon of a chilling effect, in relation to not only data protection but workers’ rights and protections and environmental protections. We have seen over time domestic laws challenged in the context of trade agreements as being an unlawful restraint on trade, rather than the trade dispute settlement bodies recognising the public purpose intended and necessary in the domestic laws, be they environmental protection or workers’ rights. I would also add that, as far as I am aware that—again, I am not an expert on trade law—because these provisions are quite new, we do not have a long corpus of trade decisions where these questions have been asked and answered in trade disputes, so there is an uncertainty about how that will play out.
Q132 Anthony Mangnall: Sorry to slightly tread over old ground here, but is there a general expectation that Australia is going to upgrade its terms? Last week or the week before, this Committee had a former New Zealand ambassador talking about signing agreements with China, saying that they had higher standards, and giving wonderful examples of how New Zealand had improved all these things. It wasn’t so much that China had necessarily improved from entering into that free trade agreement. To transfer that to Australia around digital, do we think they are going to move on this? Do we think that there will be better rights and provisions for citizens or are we kidding ourselves?
Swee Leng Harris: I think that Australia is currently in pre-pre-election mode. The focus of attention is on the realpolitik of winning that election. I would not dare speculate on what will happen under whichever Government is elected after that.
Q133 Anthony Mangnall: We are politicians. We are always in pre-pre-election mode. That should not come as any surprise. Coming back to the idea of this adequacy point, are you worried about the impact that this has with the EU? You touched on it earlier, and I would like to hear more on it.
Swee Leng Harris: Yes. I am quite worried about the future of the UK’s adequacy determination from the EU, not so much because of this particular trade agreement but because of other policy statements, as well as consultations, that the UK Government have put out into the public space.
Again, in the consultation on the future of data protection laws in the UK, a number of suggestions were made. One was around the reuse of data for new purposes, which would run counter to the purpose limitation principle of the GDPR. One was around the expansion of processing for legitimate interests, which would lower the standard for relying on legitimate interests as the basis for the processing of personal data. There were proposals around reform of the ICO, the Information Commissioner’s Office, as well as these proposals to lower the standards and protections that the UK requires for international data transfers.
Taken together, these suggestions would put at risk the adequacy determination from the EU. The adequacy determination itself specifically has a number of paragraphs about international transfers, or onward transfer from the UK to third countries. It is something that the European Commission was quite concerned about when it made the determination. It is also something that the European Parliament was concerned about after a report by one of its committees.
The point is that the EU is watching, and watching intently. These proposals and this direction of travel—particularly the UK Government’s stated public policy in relation to data transfers, which, as a matter of priority, is to have adequacy determinations for both Australia and the US—if the UK Government followed through on that policy, that would be a cause for concern, I imagine, for EU institutions in relation to our adequacy with them.
Q134 Anthony Mangnall: Is there a specialised trade committee from the TCA that deals with digital and digital trade? We have set up a whole load of specialised trade committees that deal with fishing and farming, and I wonder if there is anything on digital trade, because presumably this is something we need to be watching.
Swee Leng Harris: I understand the question. The TCA, in keeping with EU policy on digital trade, really defers to the GDPR. The TCA provided a bridging period of about six months in which the UK and EU strove for the UK to get an adequacy determination. That happened, but essentially I think the TCA would not prevail or does not meaningfully govern this. It is the EU GDPR that does.
Q135 Anthony Mangnall: As we heard from Sabina and Eunice, this is a constantly evolving process that we hope will modernise and evolve as things go on. Where does your fear lie? Are you afraid that as we do more and more trade deals it will become harder and harder to keep adequacy with the EU, or that there is the possibility we could see this evolve quite dramatically and that we could find a way through with the EU if this becomes a problem?
Swee Leng Harris: I would always hope that diplomacy can find a way through, especially if the UK takes a cautious and not-hasty approach in terms of its adequacy determinations for third countries. The risk is if the UK makes adequacy determinations for third countries, like Australia or the US, that puts them in direct conflict with the EU.
Q136 Anthony Mangnall: My problem is that I do not know how we are going to rectify this. The Government set themselves a very ambitious task of signing lots of trade deals covering 80% of our imports with free trade agreements. This is clearly going to be an issue that comes up in the immediate future. Maybe it is appropriate to say that it appears we are building a house of cards here. We can get all of these free trade agreements going, but at the stroke of a pen one aspect or one element of a free trade agreement or one party might say, “This is no longer good enough” and collapse the whole house.
Swee Leng Harris: There are two things I would say to give you some reassurance and cause for optimism.
Anthony Mangnall: I am always optimistic.
Swee Leng Harris: As one of the panellists has already mentioned, there are other ways of governing international data transfers that do not rely on an adequacy decision. You can have what are called appropriate safeguards, which are things like standard contractual terms or approved certification mechanisms. Instead of hastily providing adequacy determinations that were not warranted or merited, if the UK relied on those kinds of appropriate safeguards there would be no conflict between the different ratings and laws.
The other thing I would note is that on 22 February this year, the EU held a forum for co-operation in the Indo-Pacific. At that, a number of Governments—including the EU institutions and Australia, as well as Japan, New Zealand, Singapore, and many others—published a joint declaration on privacy and the protection of personal data. My point is that, rather than the UK and the EU needing to be in conflict, as such, we could hope for better and hope that they might have complementary parallel efforts to raise standards in other countries.
Q137 Anthony Mangnall: Sabina, you have been moving, and that is fatal in a Committee. Do you want to add anything to that?
Sabina Ciofu: I was just nodding to that idea of UK co-operation on anything, really. I was just nodding away to that idea.
I will briefly add that I don’t think there is an immediate danger to adequacy because we signed a trade agreement with Australia. I am based in Brussels. I have never heard anyone panicking over that trade deal, specifically. I think what the EU is really looking at—and the Commission will be watching closely—is what the previous panellist said about the future of the UK data protection regime.
There are constant discussions between the Commission and DCMS on this. There was constant contact throughout the consultation period on coming up with a Government response. That relationship is really strong, because the adequacy decision is very valuable for both sides and nobody wants to see it disappear overnight.
There are concerns with the UK GDPR in Brussels. There are concerns for the industry. We have concerns around the independence of the ICO and other proposed ideas in the consultation that we have been very vocal about. We are still in that period of waiting to see what the actual Government response will be, which will indicate the future, or at least the framework for the future UK GDPR. That is where we can have proper conversations on an actual text of what the Government intend to do and what the issues may or may not be, and what the issues are that will threaten adequacy if they end up in the Government consultation response.
I don’t think the trade agreements, per se, will threaten adequacy by themselves. There will be elements around the future of UK GDPR but, as was said earlier, there will be elements around who the UK grants adequacy to and how. Those will be the real questions for the Commission to consider or reconsider its adequacy decision, not necessarily the actual free trade agreements.
Q138 Anthony Mangnall: It is interesting to note that the other day an EU Commissioner suggested that they wanted to see the EU join CPTPP. One wonders whether or not the EU might update its own digital mechanisms.
Sabina Ciofu: We have seen an international recognition of the EU-UK that in the trade agreement between the EU and the UK the digital trade chapter is very strong on data flows, and it is a first for the EU. There has been movement there from the EU that I think a lot of other people, at a multilateral level in Geneva, will be excited about because it signals a potential EU-UK co-operation one day, at least in multilateral fora, on this issue to push other countries for high standards on data.
Chair: Thank you all very much indeed. That is the end of our first session. Swee Leng, Sabina and Eunice, thank you all very much indeed for helping us out this morning. It is a phenomenally complicated area. I was a Minister in the Department for two years, and even I have a headache listening to it all, but thank you for your incredibly clear answers. It helps a great deal. We are going to move on to the second session now. I will suspend the meeting for a couple of minutes while we get people in. Thank you.