Open Rights Group – Written Evidence (JTN0042)

1. Open Rights Group are grateful for the opportunity to provide our input to the EU International Agreements Subcommittee on the UK-Japan trade agreement. Open Rights Group are a digital rights campaigning organisation. We seek to help build a society where rights to privacy and freedom of speech online are respected, protected and fulfilled. We have over 20,000 engaged supporters across the United Kingdom. We advocate evidence-based policy, guided by respect for fundamental human rights.

2. Trade deals can weaken citizens’ rights by enacting mutually enforceable commitments to deregulation with limited public debate and democratic oversight. We find the UK-Japan trade agreement especially problematic, as it poses threats to both a range of digital rights as well as the process of securing a post-Brexit data protection agreement from the EU. This submission summarises our concerns, which are also available in a fuller briefing on our web site.[1] We ask the Committee to help us seek clarity on these issues from government, and we look forward to continuing to engage with you.

DATA PROTECTION, FLOWS, AND THE EU ADEQUACY AGREEMENT

3. Our most critical concerns are based around the trade deal’s implications for the UK’s data protection regime. Data protection underpins the entire service economy from shopping to banking to healthcare. The UK-Japan agreement places all of this data at risk of abuse.

4. The language of the data protection clauses of the UK-Japan trade deal are consistent with the publicly acknowledged US strategy to replace the European rights-based privacy framework which currently protect UK citizens’ personal data with the Asia-Pacific framework’s self-regulatory system as the global trade norm.[2] The EU’s Japan adequacy decision explicitly mentions the APEC-CBPR as an example of rules that “do not guarantee the required level of protection”.[3] The EU required Japan to change its data protection regime, including supplementary rules on onwards transfers of EU data to other countries. The EU Parliament has expressed further concerns[4] and Japan is considering further changes.[5] The UK, through this trade deal, is going ahead regardless.

5. The UK deal includes measures which ban restrictions on the free flow of personal data, restrictions which clash with the safeguards European data protection law requires of international transfers. These clauses, and their direct encouragement of lower data protection standards, could be a direct obstacle to the UK receiving EU data protection adequacy. The prospects for this agreement are already incredibly fragile, and the Japan deal could prove the final straw.[6]

6. This would also the create a legal mechanism which would allow data about both UK and EU citizens to enter the UK, and then be sent onwards to Japan, and then to the US, with limited safeguards and oversight. Personal data originating in the UK could then be used and sold under US legal terms, meaning without any rights to the data subject. It would also establish the UK as a hub for “data washing” – a form of innovation no government should wish to encourage.[7]

7. Dr Minako Morita-Jaeger, a Japan expert at the Sussex University UK Trade Observatory, has said that “the National Data Strategy, launched in September 2020, appears to be consistent with the Asia-Pacific approach to data governance.”[8] This raises concerns that the National Data Strategy, which government is presenting as a wholly benign domestic initiative, is in fact political legerdemain to shift the UK’s standards of data protection to the self-regulatory Asia-Pacific model, using the UK-Japan trade deals as a means to facilitate that shift without public consultation or adequate Parliamentary scrutiny.

DATA LOCALISATION

8. Separately from data flows, the UK-Japan deal contains a ban on the forced localisation of computing facilities as a condition to carry out business in the country. It is unclear to what extent this could require NHS sensitive data to be transferred to Japan and, as previously discussed, onwards to the US, given the complex public-private partnerships in place.

ALGORITHMS, SOURCE CODE, AND CRYPTOGRAPHY

9. Both the UK and EU deals with Japan contain provisions which ban the transfer of, or access to, algorithms and source code as a condition for trade. There is a growing demand for systems to become accountable through scrutiny of algorithms and source code, including from Parliament.  Restrictions on access to algorithms and source code will block these policy objectives.

10. Additionally, the UK-Japan deal introduces a specific exception for law enforcement to demand access to encrypted communications and for financial regulation. The implications of bringing cryptography into these trade deals have not been explored properly, including how it may interact with other regulations on privacy, export controls, cybercrime, or access to justice.

INTELLECTUAL PROPERTY ENFORCEMENT

11. The treaty departs from the EU-Japan agreement in the enforcement of intellectual property infractions. The text contains articles tackling the circumvention of technical protection measures (TPM) and rights management information (RMI). These anti-circumvention measures could hamper the nascent movement for the “right to repair” digital technology, which ranges from personal mobile phones to agricultural machinery programmed by software. Parliament needs to establish under what conditions the UK can establish circumvention of TPMs.

12. Additionally, some text engages on the intellectual property issues created the EU Copyright Directive, which could require sites to proactively scan user uploads for copyrighted content. While the UK has already confirmed that it will not transpose that directive, this suggests that the trade deal is being used to bring those provisions into force through the back door. Parliament needs to establish what duties flow from these provisions.
 

6 November 2020