In the final hours, the UK and the EU struck a historic trade deal that will define our long-term economic relationship with the bloc. Yet, it also set off a firing pistol for the race to secure the free flow of data with the current Trade and Cooperation Agreement containing a six-month grace period on data exchange, and did not conclude an outcome.
In the coming months the European Commission will complete its assessment of the UK’s data protection laws. As it stands, personal data can continue to be transferred freely between the EU and the UK for the duration of this specified period, without needing to implement any additional safeguards.
The challenge for Britain’s digital businesses is the prospect of a “no-deal on data” or the continued extension of this grace period – both with their associated costs of new data practices and compliance at a time when many SMEs, scaleups and even larger companies are feeling the financial strain of a third national lockdown.
Whilst we can be optimistic that UK data protection laws are of a high standard, there remain fears that divergences between the two parties could prove problematic. The EU is looking at potential concerns regarding our national security, surveillance and human rights frameworks, which could ultimately represent barriers to a data adequacy agreement. The European Court of Justice invalidated the EU-US privacy shield in the summer of 2020 – a landmark ruling that ended the access US businesses had to EU personal data – officially treating America as a “third-country”.
There are concerns that this ECJ decision might impact the UK, which could be viewed by the EU as a “backdoor” to the US for data flows. As such the UK Government must treat this issue with the urgency and attention it warrants. Securing a data agreement with the EU will be mission-critical for the UK’s tech sector.
A no-deal on data adequacy is not an option
If no framework for data adequacy is agreed, then the UK would likely default to third-country status, similar to the US. In such a scenario, British companies will be hit with an estimated ÂŁ1.6bn in new costs as they are forced to meet compliance obligations through implementation of Standard Contractual Clauses (SCCs) should they want to continue transferring personal data from the EU to the UK. Although this is a potential fallback, there is as of yet no guarantee that the EU will even accept these SCCs.
The greatest potential harm from a failure to get this right would fall on early-stage businesses with limited resources for handling the required “paperwork”. Consequently, a no-deal scenario on data flows could severely impact some of the UK’s most exciting and innovative companies, often operating in data heavy technology verticals. The ambition the UK government presents for Britain to remain an attractive destination for FDI and as a home for foreign enterprises, could also be damaged by a ruling that restricts the free flow of data.
It’s a win-win for both parties
The New Economics Foundation and UCL European Institution published recommendations last November on what the UK government can do to support achieving data adequacy with the EU.
The paper calls for further explanation on how the changes to the UK’s data protection regime can encourage growth, innovation and strengthen the rights of UK and EU citizens, as well as providing more funding towards modelling tools to support research on the socio-economic impacts of data issues.
It also cautions negotiators against a no-deal scenario, outlining potential steps the government can take to mitigate business disruption. It signals that the government should consider raising awareness of the risks and costs that a no data deal would have to the business community and potentially set aside funds to support companies seeking to be compliant with EU rules.
The UK has already said that it considers the EU 27 and EEA member states as meeting requirements of UK data protection – and so the EU is likely to have the final say, and it has good reason to back the long-term free flow of data. EU businesses would equally face extra costs to meet the compliance required to transfer data into the UK; the UK is a significant market for EU businesses in terms of cross-border data flows. After China and the US, the UK ranks third globally on cross-border flows, and 75% of UK data crosses into the EU.
The stakes are undoubtedly high for both the EU and the UK – and there appears to be continued reassurances from both parties that the ambition is the status-quo. But complacency and a lack of certainty remain significant hurdles – now is the time to get this component of Brexit right.
Russ Shaw CBE is the founder of Tech London Advocates & Global Tech Advocates.
