The impact of Brexit on EEA-UK data flows
Emily Jones, Partner at Osborne Clarke LLP
The free movement of personal data within the EEA is a cornerstone of the Single Market – crucial to businesses and consumers operating in the EEA. For users and providers of cloud services within the EEA, it is essential for frictionless data transfers.
However, the UK government has confirmed that it will not be seeking membership of the Single Market as part of its Brexit negotiation strategy – it will be pursuing instead a new strategic partnership with the EU, which, on the face of it, would be incompatible with continued UK membership of the EEA or the EFTA. Comments in the UK government's white paper on principles underpinning its Brexit negotiation strategy and from the UK Minister of State for Digital and Culture shed some initial light on how the UK government intends to negotiate uninterrupted EEA-UK data flows.
The reason why this is a potential issue is because current and future EU data protection laws are, by default, designed to ensure the free movement of personal data between: (a) EU member states; and (b) European Economic Area (EEA) states who are not members of the EU (Iceland, Norway and Liechtenstein), but who are bound to comply with certain fundamental EU rules and restrictions in return for being included in the Single Market. Those laws restrict the transfer of personal data to "third countries" outside the EEA without adequate protections in place. On the basis that the UK will be regarded as a "third country" for data protection purposes under any Brexit model in which it falls outside of the EEA, businesses would be restricted from transferring personal data from the EEA to the UK unless: (a) the European Commission has deemed the UK to offer "adequate protection"; (b) a EU-US Privacy Shield style arrangement is agreed between the UK and the European Commission; or (c) the business uses some other form of transfer mechanism in the same way as is currently permitted by the EU Data Protection Directive (e.g. standard contractual clauses or binding corporate rules).
The UK government’s key messages on these issues are as follows:
(a) it would aim to ensure that any new strategic partnership with the EU, including "an ambitious and comprehensive Free Trade Agreement" would "take in elements of current Single Market arrangements in certain areas" (which presumably could include free movement of personal data);
(b) it recognises the importance of the stability of EEA-UK data transfers for many sectors and that maintaining frictionless data flows between the EEA and UK is a core goal for the UK government to pursue in the Brexit negotiation process;
(c) implementing the GDPR fully into UK law so that it is harmonised with the European legislation is a key way that the UK can "maximise the ease" with which it can negotiate uninterrupted and unhindered EEA-UK data flows post-Brexit;
(d) it does not foresee any significant changes being made to UK data protection laws once the UK leaves the EU;
(e) it is aware of the European Commission's ability to recognise data protection standards in third countries as being "essentially equivalent" to those in the EU; and
(f) whilst Brexit negotiations have yet to begin it is unable to give any other details of what other arrangements the UK might put in place to ensure the seamless flow of personal data between the UK and EEA post-Brexit (including whether it will pursue an 'adequacy decision' or adopt another method to ensure the unhindered flow of personal data (presumably some sort of EU-US Privacy Shield style or similar arrangement)).
The success of the UK government's Brexit discussions around data transfers will ultimately hinge on the UK securing a suitable solution to legitimise data transfers from inside the EEA to the UK. The possibilities include: (a) the European Commission deems the UK to offer "adequate protection"; or (b) an EU-US Privacy Shield style arrangement is agreed between the UK and the European Commission.
However, for various reasons the UK government is likely to face a number of political, legal and procedural challenges in securing an adequacy decision or alternative long-term data transfer solution despite the UK's close historical association with strict EU data protection laws, the UK government's intention to implement the GDPR in the UK from 25 May 2018 and the UK data protection regulator's public commitments to taking an active role in ensuring UK adequacy.
Businesses will therefore be closely monitoring upcoming discussions and negotiations in order to ensure appropriate transfer mechanisms are in place once the UK leaves the EU.
Article published by: Emily Jones, Partner at Osborne Clarke LLP
Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project
CPC project office: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.at