TechUK and UK Finance have called on the UK Government and the EU to act quickly to prepare a mutual adequacy agreement to enable the continuing protection for cross-border exchange of personal data between the two regions by customers and business following Brexit.
Every day, vast amounts of personal data are moved across national borders by citizens, business and organisations from banks and online retailers to cloud services and academic organisations. A common regulatory regime promotes world-leading standards of data protection and privacy on a cross-border basis.
In a joint report commissioned from international law firm Dentons, No Interruptions: options for the future UK-EU data sharing relationship, techUK and UK Finance detail how mutual adequacy agreements between the UK and EU, preceded by a transition period maintaining current arrangements for a set period, would preserve the strong working relationships already in place and offer businesses much-needed regulatory certainty.
When the UK leaves the EU in March 2019, it will lose the automatic legal framework for the free flow of personal data. Unless a new arrangement is agreed, transfers of personal data across Europe will be severely limited – requiring alternative mechanisms which can be costly or complex – or stop, potentially at huge financial cost for both economies. It is in the interests of both the UK and EU27 to act on this issue as soon as possible.
The outcome requires the following actions:
- Both the EU and the UK should begin their adequacy assessment processes as soon possible.
- A stand still transitional arrangement for a set term in order to avoid a “cliff-edge” in the movement of personal data should be agreed immediately.
- The UK should consider implementing additional measures to ensure that any EU concerns about the UK’s data protection framework are addressed, particularly regarding processing of data for UK national security purposes.
- The UK should ensure that its international and ‘onward transfer’ regimes, including with the US, provide equivalent levels of protection to those set out in the EU’s regime as this will form a key part of the EU’s adequacy assessment.
Julian David, CEO, techUK comments, “We are a data-driven economy and our success is underpinned by our ability to move that data cross-border. With the Brexit deadline growing ever closer, time is of the essence. The UK and EU must recognise each other’s data protection frameworks as adequate as soon as possible. This should be a priority for Phase Two of Brexit negotiations.
“This isn’t solely for the benefit of one industry or one country but for the whole European economy as cross-border data flows become ever more important for trade and the ability to do businesses.”
Stephen Jones, CEO, UK Finance adds, “It may not always be obvious, but every aspect of our economy as well as our everyday lives rely in some way or another on data. In its current form, the EU’s interconnected regulatory environment facilitates millions of vital data exchanges every day.
“Leaving this relationship will result in significant changes and time must be allowed for new agreements to be put in place. The UK and EU should implement transitional arrangements maintaining the status quo to give both sides time to agree how they will deliver high standards of data protection, allowing both communication and trade to flourish.”