The UK government should immediately open talks to secure a Data Adequacy Decision from the European Commission, MPs said in a new report published on Tuesday (2 July).
The report by MPs on the UK Parliament’s Exiting the EU committee adds that the UK government should accept the jurisdiction of the European Court of Justice in data protection law to increase its chances of obtaining an adequacy decision.
The UK has already applied the General Data Protection Regulation (GDPR) into its national law.
But after formally leaving the EU next March, the UK will be classified as a ‘third country’, and its application of GDPR will not guarantee an adequacy decision – which determines that a third country has an adequate data protection regime, and that European personal data can be processed there.
Prime Minister Theresa May has made a deal on continued data transfers one of her priorities in the Article 50 talks. In a speech in March, May stated that the UK had “exceptionally high standards of data protection” and wanted to “secure an agreement with the EU that provides the stability and confidence for EU and UK business and individuals”.
The UK is seeking an ‘adequacy +’ deal as part of a treaty on security and defence rather than solely a one-way decision of the European Commission.
The new pact would involve the UK having a say on future data protection laws in Europe, and a future role for the UK’s Information Commissioner on the European Data Protection Board.
But MPs warned that this kind of arrangement is unprecedented and could take longer to broker than the 21 month transition period that is expected to run from March 2019 to December 2020.
“An adequacy decision is not automatic and, because this is the first time a Member State has chosen to leave the EU and then seek an adequacy decision, the timetable is difficult to predict. There is a risk that it could take longer than the transition period,” said the committee.
Without an adequacy decision before the UK formally exits the EU, companies would need to put complex legal clauses in their contracts or term of service and may need to have these sanctioned by an EU DPA.
The EU’s digital market is one of the more integrated economic sectors. €272 billion of trade in Europe relies on data flows, but a data deal is particularly important to the UK, for whom three quarters of cross border data flows are with EU countries.
The UK has established itself as the EU’s leading digital tech hub. Around 25% of the information technology professionals in the EU are currently based in the UK. However, France, Ireland and Amsterdam have been positioning themselves as potential alternatives to the UK for tech firms anxious to retain unfettered access to the EU’s single market.
“We have welcomed the fact that the Prime Minister and (Digital Minister) Matt Hancock have made data one of their priorities as a part of any deal, but the clock is ticking and so far we are no closer to an agreement,” Dom Hallas, executive director of Coadec told EURACTIV.
“Startups are clear that forward thinking and ambitious proposals on data need to be at the centre of any deal and we are supportive of the UK Government’s attempts to forge a bespoke path – but adequacy is infinitely better than no data deal,” he added