Data Protection after Brexit

Author Furfur
Licence Creative Commons Attribution Share Alike 4.0 International

Jane Lambert

Because of the importance of its financial services industry, preserving an uninterrupted flow of personal data across national frontiers is particularly important to the UK.  At present, such flow is guaranteed by art 1 (3) of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("the GDPR").  When the UK leaves the EU, the GDPR will cease to apply to  this country and the UK shall become a third country for the purposes of Chapter V of the GDPR.

Our exit from the UK will have no effect on the obligations of data controllers and processors in the UK or the rights of data subjects anywhere with regard to UK controllers and processors because s.3 (1) of the European Union (Withdrawal) Act 2018 will incorporate the GDPR into our law.  The Department for Digital, Culture, Media and Sport has confirmed in its guidance note Data Protection if there's no Brexit deal of 13 Sept 2018 that

"[i]n recognition of the unprecedented degree of alignment between the UK and EU’s data protection regimes, the UK would at the point of exit continue to allow the free flow of personal data from the UK to the EU"

though it adds that  the UK would keep this under review.  On the other hand, art 44 of the GDPR makes clear that data controllers and processors in the states that remain in the EU would be able to transmit personal data to the UK only in accordance with the provisions of Chapter V of the regulation.

Art 45 (1) of the GDPR provides:

"A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection."

The  Department for Digital, Culture, Media and Sport's guidance note notes that the "European Commission has stated that if it deems the UK’s level of personal data protection essentially equivalent to that of the EU, it would make an adequacy decision allowing the transfer of personal data to the UK without restrictions." However it adds that while HM government wants to begin preliminary discussions on an adequacy assessment now, the Commission has stated that a decision on adequacy cannot be taken until the UK is a third country. 

Unless and until the Commission makes an adequacy assessment businesses in the UK must rely on one of the other provisions of Chapter V of the GDPR.  The guidance note suggests:

"For the majority of organisations the most relevant alternative legal basis would be standard contractual clauses. These are model data protection clauses that have been approved by the European Commission and enable the free flow of personal data when embedded in a contract. The clauses contain contractual obligations on you and your EU partner, and rights for the individuals whose personal data is transferred. In certain circumstances, your EU partners may alternatively be able to rely on a derogation to transfer personal data."

It recommends businesses proactively to consider what action they may need to take to ensure the continued free flow of data with EU partners.

If the British government and EU reach a withdrawal agreement in time for ratification before the 29 March 2019 there will be an implementation period in which the GDPR will continue to apply to the UK until 31 Dec 2020.  What happens after that will depend on the terms of the agreement on the future relationship between the EU and the UK.  At para 3.2.1 (8) of its while paper The Future Relationship between the United Kingdom and the European Union (Cm 9503) the government says:

"The UK believes that the EU’s adequacy framework provides the right starting point for the arrangements the UK and the EU should agree on data protection but wants to go beyond the framework in two key respects:

a. on stability and transparency, it would benefit the UK and the EU, as well as businesses and individuals, to have a clear, transparent framework to facilitate dialogue, minimise the risk of disruption to data flows and support a stable relationship between the UK and the EU to protect the personal data of UK and EU citizens across Europe; and
b. on regulatory cooperation, it would be in the UK’s and the EU's mutual interest to have close cooperation and joined up enforcement action between the UK's Information Commissioner's Office (ICO) and EU Data Protection Authorities."

It is still not clear whether the EU will agree to the white paper proposal or even whether there will be a withdrawal agreement that will allow a transitional period,

Anyone wishing to discuss this article or data protection generally should call me on 020 7404 5252 during office hours or send me a message through my contact form.

HMG's Exchange and Protection of Personal Data Position Paper

Jane Lambert

Even though it has absolutely nothing to do with the rights of the citizens of the remaining member states in the UK or those of British citizens rights in the remaining member states, the Irish border or our residual financial commitments to the EU budget that are the subject of the present art 50 negotiations. our government has published a position paper entitled  The exchange and protection of personal data. The paper discusses how the UK could continue to cooperate with the Commission and the supervisory authorities of the other member states on data protection if and when it leaves the EU in March 2019.

The government's thinking is not hard to discern.  Despite attempts by the Coalition and Conservative Governments to rebalance the British economy since 2010, it remains overwhelmingly services orientated. Financial services are particularly important to the United Kingdom and these depend on the free flow of personal data.  If and when we leave the European Union, the General Purpose Data Protection Regulation will cease to apply to us and we shall become a "third country" for the purposes of the Regulation.

Art 44 of the Regulation would then apply:

"Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined."

In other words, the unrestricted flow of personal data between financial institutions in the UK and their customers, suppliers and partners in the remaining EU member states, which is the lifeblood of the banking, insurance, fintech and so many other industries, ceases unless and insofar as the provisions of Chapter V of the Regulation can be met.

The position paper seems to be a response to art 44 of the Regulation. Paragraph 4 of the paper states:

"After the UK leaves the EU, new arrangements to govern the continued free flow of personal data between the EU and the UK will be needed, as part of the new, deep and special partnership. The UK starts from an unprecedented point of alignment with the EU. In recognition of this, the UK wants to explore a UK-EU model for exchanging and protecting personal data, which could build on the existing adequacy model, by providing sufficient stability for businesses, public authorities and individuals, and enabling the UK’s Information Commissioner’s Office (ICO) and partner EU regulators to maintain effective regulatory cooperation and dialogue for the benefit of those living and working in the UK and the EU after the UK’s withdrawal."

Paragraph 6 emphasizes the UK's vulnerability in this regard:

"Estimates suggest that around 43 per cent of all large EU digital companies are started in the UK, and that 75 per cent of the UK’s cross-border data flows are with EU countries. Analysis indicates that the UK has the largest internet economy as a percentage of GDP of all the G20 countries, and has an economy dominated by service sectors in which data and data flows are increasingly vital. The UK accounted for 11.5 per cent of global cross-border data flows in 2015, compared with 3.9 per cent of global GDP and 0.9 per cent of global population, but the value of data flows to the whole economy and the whole of society are greater still."

As the next paragraph notes, any disruption of cross-channel data flows would harm both the UK and the remaining member states but it would harm the UK more because financial services are so important to this country. Moreover, disruption of data flows between London and the rest of the EU might be the ill wind that diverts business and investment from London to continental financial centres and Dublin.

The paper is very short - some 15 pages including the covers.  The first 4 paragraphs are an executive summary.  The next 5 are an introduction which stresses the importance of transborder data flows for financial services and security cooperation. The following 3 headed "Context" explain why states need data protection laws. The paper traces the UK's commitment to data protection back to Younger though it omits to mention that a major incentive to implement our own data protection legislation was the refusal of the Swedish data protection authority on 12 April 1974 to allow a Swedish local authority to transmit health and social security records to a British company that had contracted to supply plastic identity tags. The next four paragraphs summarize the General Data Protection Regulation and the Data Protection Directive and the UK's plan to continue the protection afforded by that legislation with a new Data Protection Bill (see my article What will happen to the GDPR in the United Kingdom after Brexit? 10 Aug 2017 NIPC Brexit). Other international arrangements for data protection such as the Council of Europe Convention and the OECD Guidelines on Transborder Data Flows are discussed in paragraphs 17 and 18.

The really interesting bits of the paper are paragraphs 19 and 22 which outline the UK's objectives. Paragraph 21 states that it is the UK’s ambition to remain a global leader on data protection, by promoting both the flow of data internationally and appropriate high levels of data protection rules and paragraph 22 explains why:

"as the UK and the EU build a new, deep and special partnership, it is essential that we agree a UK-EU model for exchanging and protecting personal data, that:

• maintains the free flow of personal data between the UK and the EU; 

• offers sufficient stability and confidence for businesses, public authorities and individuals; 

• provides for ongoing regulatory cooperation between the EU and the UK on current and future data protection issues, building on the positive opportunity of a partnership between global leaders on data protection; 

• continues to protect the privacy of individuals; 

• respects UK sovereignty, including the UK’s ability to protect the security of its citizens and its ability to maintain and develop its position as a leader in data protection; 

• does not impose unnecessary additional costs to business; and 

• is based on objective consideration of evidence."

The remainder of the paper discusses the close cooperation between the Information Commissioner and her opposite numbers elsewhere and the undoubted advantages of maintaining that cooperation. Realistically, the paper also includes an annexe on how businesses can comply with Chapter V of the Regulation if there is no UK-EU model but observes that that would be much more burdensome for business than somehow finding a way to continue the existing arrangements.

The paper shows that a UK-EU model for exchanging and protecting personal data is something that the British need badly from the art 50 negotiations. It is not yet on the formal agenda and if I were advising Michel Barnier and his team I would not be in a hurry to put it on the agenda unless and until we see some movement on the rights of citizens at least equivalent to those of investors in bilateral investment treaties and maybe a little bit more money into the divorce settlement.

Should anyone wish to discuss this article or data protection law generally, he or she should call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form.