EU releases its position on data protection post-Brexit

Yesterday the European Commission released a number of new position papers on Brexit. One of the most important areas covered within these is the future relationship between the UK and EU when it comes to data use and protection.

The UK has already published its own report last month, where it set out that EU data protection law would become UK law in order to maintain the free flow in data.

In the report the UK Government said: “At the point of our exit from the EU, the UK’s domestic data protection rules will be aligned with the EU data protection framework.”

The Data Protection Bill will make the GDPR UK law and it will remain so even after Brexit, as it is a piece of domestic legislation.

However, the EU paper gives little away in terms of what deal the EU Commission will be seeking to strike with the UK to maintain the free flow in data.

The paper makes no mention of adequacy status. The EU can award countries that are deemed to have ‘essentially equivalent’ data protection standards something called adequacy status. This allows a country outside the EU to exchange data with EU countries.

The UK, in its own paper, signalled that it wanted to build upon the adequacy status framework. It said: “The UK wants to explore a UK-EU model for exchanging and protecting personal data, which could build on the existing adequacy model, by providing sufficient stability for businesses.”

The EU’s position paper does little to clarify this but does give some hints on what the EU Commission thinking is.

In Section 1 of the paper it explains that EU citizens should have all their full rights under the GDPR, if their data is being processed in the UK after Brexit. The Data Protection Bill, when passed will ensure that this is the case.

The process could hit some obstacles if the UK substantially diverges from the GDPR in the Data Protection Bill. If it is a copy and paste job, barring the areas where member states can vary the Regulation then the process should be smoother. However, the UK Government may decide to make other amendments and this could potentially complicate the process.

Chris Combemale, CEO of the DMA group, said: “The EU’s current position is not just a threat to the UK economy, but to success of Europe as a whole. Maintaining the free flow of data is essential for future growth both on the continent and in the UK. The EU’s paper starkly illustrated that not reaching an agreement on this issue poses a real risk to every data-driven business in the UK, which is to say almost every company.

“In August the UK Government set out a reasonable approach in its own policy paper, which clearly set out the plan to enshrine the GDPR into UK law providing a framework for the continued free flow of data across Europe. In our own study, we found that 76% of businesses want to retain access to the digital single market post-Brexit, highlighting the importance of this issue to the majority of UK companies.”

Maintaining the free flow of data between the UK and EU is extremely important to not only British businesses, but EU ones too. Some of the UK’s biggest markets for its advertising and marketing services are in Europe, such as, France and Germany.

Disrupting trade in this way is a lose-lose for both the EU and the UK. It is imperative that a deal is struck that maintains the free flow of data so that once the UK leaves the EU, data exchanges can continue unhindered.

The position paper published yesterday offers little clarity to businesses struggling with economic uncertainty.

Combemale continues: “The EU’s paper also makes no mention of the status of the UK’s ICO and retaining a position on the European Data Protection Board, something the UK Government made clear it would want to retain. At the DMA, we believe this is a key issue and its omission is a concern. We continue to call for the ICO to have a full voting place on the EDPB following withdrawal and that this issue urgently be added to the discussions.

“Furthermore, the EU’s attempts to restrict the UK’s ability to agree trade deals with other nations by removing separate data transfer protocols from future agreements is a threat to freedom and democracy. The UK is already a global leader in the data-driven economy and unfettered access to the digital single market is important to its continued success, therefore the free flow of data between the UK and EU is a must for any future trade deal.”