UK to reform data protection, throwing EU adequacy ruling into doubt

Among the concerns from Brussels is the UK’s stated desire to establish new data flows with countries including the US, Australia, South Korea and Singapore, which it is feared could lead to the transfer of EU individuals’ data to third countries with inadequate privacy standards. [Shutterstock / Mistervlad]

The UK’s legislative agenda for the next year includes a data reform bill that could cast doubts on the future of the EU’s data adequacy ruling, the decision that continued to facilitate data transfers across the Channel after the UK left the bloc in January 2020.

The bill was amongst those included in this year’s Queen’s Speech, the formal opening of Parliament, in which the monarch sets out the government’s legislative plans for the upcoming year. This year, however, the Queen did not attend for health reasons and the agenda was presented by Princes Charles and William. 

Queen Elizabeth pulls out of parliament opening because of 'mobility problems'

Britain’s Queen Elizabeth will not carry out the opening of parliament on 10 May as the 96-year-old monarch has had a recurrence of mobility issues, Buckingham Palace said, the latest event she will not attend because of her health.

Following the country’s departure from the EU, the UK government introduced a bill implementing the GDPR, the EU’s data protection law, but Prime Minister Boris Johnson announced in 2020 his willingness to deviate from the EU framework and develop separate policies. 

A year later, the EU adopted its data adequacy decision, ruling that the UK’s data protection as it stood was sufficient to continue EU-UK data transfers. But it put in place measures to allow the Commission to reverse this decision should UK policy change substantially.

One such example is a ‘sunset clause’, making the decision automatically expire in 2024, at which point renewal will be contingent on the UK having kept in place comparable standards. 

Commission adopts UK data adequacy decision with provisos

The European Commission on Monday (28 June) adopted two adequacy decisions for the UK, including measures that would enable Brussels to revise the decision in case of changes in the UK legal framework.

Among Brussels’ concerns is the UK’s stated desire to establish new data flows with countries including the US, Australia, South Korea and Singapore, which it is feared could lead to the transfer of EU individuals’ data to third countries with inadequate privacy standards. 

Details of what the reforms might include have yet to be released, but at the opening of a public consultation on the initiative last year, the government said it aimed to deliver a data protection regime that would minimise “unnecessary barriers to responsible data use” along with “undue uncertainty or risk” for businesses and equip the Information Commissioner’s Office for regulation in a more data-driven environment.

According to Sky News, the bill will make up part of a wider package of data protection reforms, which will include the abandonment of cookie consent banners. Sky also reports that the government is set to release its response to the consultation on the reforms within the next few weeks, with the potential publication of the draft bill by the summer.

The future of data adequacy 

“The Commission’s original decision to grant the UK data adequacy was already legally questionable because the UK was repeatedly found to have breached EU law because of how British national security agencies collect personal data,” Zach Meyers, a senior research fellow at the Centre for European Reform, told EURACTIV. 

“If the UK diverges further away from the GDPR, then the Commission may feel it has no choice but to withdraw adequacy”, he said.

Minor reforms, he added, might not be found to jeopardise individuals’ GDPR rights in a serious way, but added that if the UK government pushes ahead with more revolutionary reforms, such as undermining the data protection regulator’s independence, “the Commission will have to consider carefully whether to withdraw adequacy.”

If adequacy is lost, the UK might be able to realign itself with other countries in the longer term, but the immediate costs of adjustment would likely hit UK businesses hard.

The year in digital policy

Also laid out in the Queen’s Speech were a number of other digital proposals. A Broadcasting Bill is set to privatise the UK’s Channel 4, which is currently publicly owned, while the Online Safety Bill, an initiative to regulate online service providers introduced in March, was carried over into the next session.

UK's expanded Online Safety Bill moves forward

The UK today introduced its Online Safety Bill in Parliament after a lengthy preparation process that has ignited debate on many aspects of the balance between protecting people from online harms and preserving their online freedoms. 

More broadly, the government is also set to introduce the so-called “Brexit Freedoms Bill”, which will ease the process of abandoning the EU law that remains on the UK’s books, by ending its special status.

Not included, on the other hand, was legislation that would empower a new digital regulator, the Digital Markets Unit, which was preliminarily established last year and which is currently operating without statutory backing.

UK jettisons legislation to empower digital regulator

A bill that would have legally empowered the UK’s new tech regulator was notably absent from today’s presentation of the government’s annual legislative agenda.

[Edited by Luca Bertuzzi/Zoran Radosavljevic]

Subscribe to our newsletters

Subscribe