The House of Lords European Union Committee in its recent report Brexit: the EU data protection package recommended an adequacy decision as the most comprehensive mechanism for the UK to continue to share data with the EU post-Brexit.
The report notes that three-quarters of the UK’s cross-border data flows are with EU countries. This highlights the importance of ensuring that there is an appropriate platform in place for the cross-border data flows between the EU and the UK post-Brexit. The Committee supports the Government’s objective to maintain uninterrupted data transfers as outlined in the Government’s recent White Paper. However the Committee also points to the lack of detail within the paper on how this outcome will be achieved.
The report notes the likelihood that the UK will become a “third country” in relation to data protection law, and as a result will become subject to the same requirements as countries such as the US and Canada. The Committee believes that an adequacy decision would provide the most comprehensive platform for the UK to continue to transfer data to the EU post-Brexit. Interestingly as the UK would be regarded as a third country, this would result in the UK being held to a higher standard than EU member states. As a third country, the UK would no longer be able to rely on the national security exemption as provided for in the Treaty on the Functioning of the European Union.
The recent Opinion of Advocate General Mengozzi of the CJEU on the proposed EU-Canada Agreement on the transfer and processing of passenger name record data is also of significant interest here. The Advocate General found that while sensitive data may be transferred from the EU to Canada, the protection of public security alone is not a sufficient justification for this transfer. As a result, if this opinion is followed by the ECJ, the UK may have a difficult time justifying data transfers with the EU based solely on public security. It seems that the balance is shifting in favour of the fundamental right to privacy and data protection and away from the reliance on the defence of maintaining public security.
Without an adequacy decision UK businesses will have to deal with additional burdens and costs associated with ensuring that EU data transfer mechanisms will comply with EU law (e.g. by way of binding corporate rules or standard contractual clauses). This could in turn place UK businesses at a disadvantage to their competitors in the EU. Businesses will undoubtedly be paying close attention to developments in this area as the Brexit negotiations proceed.
Follow us on Twitter @WFIDEA and @WilliamFryLaw
