Brexit: Potential Blow To Data Adequacy As EU Top Court Rules Against Surveillance Data Storage

In a potential blow to the UK's hopes of reaching data adequacy agreement with the EU, the European Court of Justice today ruled that EU countries cannot retain citizens' data in a sustained way for intelligence purposes (unless there is a clear and present danger to national security).

Very simply, the ECJ has ruled that mass surveillance illegal. Mass surveillance - the tracking and storage of nearly all personal digital data as a method of investigating and monitoring threats to national security - is a practice used by the UK and many other countries around the world.

This has potentially damaging implications for the UK's hope of securing a data adequacy deal with the EU. The data adequacy agreement is necessary for the continued free-flow of data between the UK and EU. Such an agreement is given by the EU to countries whose data protection practices are essentially the same, and permits those countries to store and process of personal data of EU citizens. This is necessary for a multitude of companies to prospect, advertise and fulfil product and services delivery to people in the EU.

The UK has already committed to recognising EU standards as sufficient to store UK citizens' data in Europe, but the EU is obligated to go through an adequacy assessment regardless of the apparent similarity of data laws. This process is ongoing.

While the data protection rules are the same in the EU and UK (stemming from GDPR), concerns over the UK's surveillance practices had already been raised by the EU as potential breaches to EU citizens' rights. The ruling today gives legal justification those concerns.

It may be the case that, for the UK to reach a data adequacy agreement, it would have to scale back its surveillance practices. Given the UK's hard stance on conforming to EU rules post-Brexit, it is unlikely that the UK Government would be willing to do this.

Theoretically, it is possible that the UK and EU will reach an agreement containing security cooperation, which may permit the UK to utilise mass surveillance if it shares information with the EU. But, given that the EU is not permitting its member states to do this, it is extremely unlikely they would permit a 'third country' to do this.

The DMA's Brexit Toolkit outlines the means by which companies can exchange data with the EU post-Brexit, regardless of the type of deal (or lack thereof).

For further questions, contact Head of Public Affairs, Michael Sturrock.