The United Kingdom will seek to diverge from EU data protection rules and establish their own ‘sovereign’ controls in the field, the UK Prime Minister Boris Johnson said on Monday (3 February). His comments came despite the EU affirming that the UK should “fully respect EU data protection rules.”
In a written statement to the House of Commons published yesterday, the Prime Minister said that the United Kingdom will “develop separate and independent policies” in a range of fields, including data protection, adding that the government would seek to maintain high standards in so doing.
Moreover, speaking to reporters on Monday, Johnson said that the UK has no need to bind itself to an agreement with the EU. “We will restore full sovereign controls over our borders, immigration, competition, subsidy rules, procurement, data protection,” he said.
Meanwhile in Brussels, the European Commission released a recommendation for opening trade negotiations with the UK, highlighting previous commitments that both parties had made to maintain consistency in data protection standards.
“In view of the importance of data flows, the envisaged partnership should affirm the Parties’ commitment to ensuring a high level of personal data protection, and fully respect the Union’s personal data protection rules,” the document states, adding that data transfers made post-Brexit between the UK and the EU should be preceded by an adequacy agreement.
The EU’s flagship personal data protection regime, the GDPR, sets down baseline requirements for data protection standards, and addresses minimum privacy standards for transferring EU data outside of the bloc. For countries not based in the EU, adequacy agreements are often signed between the EU and the other party, as a means of safeguarding personal data.
The European Commission has previously stated that the assessment for an adequacy agreement between the UK and the EU will begin on 1 February. The steps to adopt an adequacy agreement, allowing for data transfers between the EU and the UK, would involve a period of Assessment by the Commission, followed by a draft decision from the EU’s executive arm, an opinion by the European Data Protection Board and then a final approval by member states and the College of Commissioners.
In January, the UK’s digital secretary Nicky Morgan hinted at the direction the country would take as part of its National Data Strategy, post-Brexit, saying that she would seek to “fully and responsibly unlock the power of data, for people and organisations across the UK.”
However, there have been fears among data activists that the UK would not meet the EU’s level of required standards in order to adopt a data adequacy agreement, and by extension, potentially obstructing data transfers between the EU and the UK.
Heather Burns, a tech policy specialist and creator of the Afterbrext.tech website, told EURACTIV towards the end of last year that the UK’s history in conducting widespread surveillance programs would “no doubt” play into the Commission’s evaluation of the UK’s data protection standards, alongside the fact that the country has been “barely compliant with regards to GDPR,” since implementation.
The UK has a controversial track record in mass surveillance programs, evidenced in a European Court of Human Rights ruling in 2018, which found that the UK had breached human rights protections in its mass surveillance program, afforded legitimacy by the Investigatory Powers Act (RIPA).
EURACTIV pressed Number 10 for clarification on Monday. At the time of writing, no official response has been received.
The UK government position on adopting a divergence from EU data protection is a major change from former Prime Minister Theresa May, who had committed to ensuring that the GDPR would be in UK law.
More generally on Monday, Johnson set out his stall for the forthcoming UK EU trade negotiations, which are set to commence in March. The Prime Minister said that the UK would refuse to abide by EU regulatory standards generally, prompting the EU’s Chief Brexit Negotiator Michel Barnier to claim that Johnson was backtracking on earlier commitments.
(Edited by Benjamin Fox)