August 28, 2019
Brexit could cause major disruption to EU-UK data flows
UK businesses could be in for a huge headache if the government fails to secure an agreement on data flows between the E.U. and the U.K. post-Brexit, according to a new report published by UCL European Institute.
The report, "EU-UK Data Flows, Brexit and No-Deal: Adequacy or Disarray," outlines the kinds of bureaucracy that businesses might face in the case of no-deal Brexit, which includes having to invest in legal and administrative fees to ensure E.U.-UK data transfers remained lawful.
"There has been intense political focus on the issue of trade in goods, particularly in regards to the border with Ireland. By comparison, issues relating to data flows and trade in services more broadly have been neglected. This is despite the fact that services comprise 80% of the U.K. economy, and disruption to E.U.-UK data flows could be as economically damaging as disruption to trade in goods," said Research Associate and co-author of the report, Oliver Patel (UCL European Institute).
The report outlines the E.U.'s legal and policy approach to data protection, providing an overview of the General Data Protection Regulation (GDPR) and the E.U. data governance framework. It highlights E.U.-third country data relationships, including for EEA countries and ranging from those with a full data agreement to countries where there is no formal arrangement.
The findings are based on interviews that the researchers carried out with over 50 people including E.U. and U.K. politicians, civil servants, ambassadors, regulators, lawyers, business leaders and policy professionals between 2017 and 2019.
Personal data flows freely between the E.U. and the U.K., and it has done since the emergence of the modern internet and digital economy. The free flow of data within the E.U. is enabled by harmonised data protection rules and common systems of regulatory enforcement. E.U. Member States also have shared arrangements for data flows with non-EU (i.e. third) countries.
The only way data flows can remain seamless post-Brexit is if the E.U. issues an 'adequacy decision," which is a tool for assessing data protection rules in non-EU countries and deciding whether they meet E.U. standards.
The researchers outline three possible 'no-deal on data flows' scenarios which would leave the U.K. without an adequacy decision: 1) No Withdrawal Agreement: 'cliff edge' Brexit;
2) Withdrawal Agreement but no adequacy decision; 3) Adequacy decision after the transition period ends.
The report highlights that there is no guarantee of the U.K. being given a positive adequacy agreement, due to concerns raised by E.U. officials about the U.K.'s surveillance and national security practices. The general view from the E.U. is that post-Brexit the U.K. will be treated as a "third country," whereby they would be expected to follow stringent requirements.
"The U.K. wants to go beyond 'adequacy' for its data relationship with the E.U. However, there is a risk that it might not even get a positive adequacy decision," Patel said.
"Three-quarters of the U.K.'s international data flows are with the E.U., and much U.K. economic activity is dependent on these flows. Disruption—particularly in the case of a no-deal Brexit would place immense compliance burdens on businesses," he concluded.