The House of Lords EU Home Affairs Sub-Committee recently published a report on the EU Data Protection reforms and the impact of Brexit. The report acknowledges the importance of maintaining unhindered personal data flow between the EU and UK post-Brexit and concludes with the following recommendations.
1. The report expresses concern at the lack of detail around how the Government plans to achieve its aim of unhindered personal data flows. It notes that without such an arrangement, police and security cooperation would be at risk and the situation may present a non-tariff barrier to trade.
2. It suggests the UK secures an adequacy decision from the European Commission as the most effective way to ensure unhindered flows of data between the EU and UK post-Brexit. This would confirm that the UK’s data protection rules provide an equivalent standard of protection to the EU.
3. Although it considers alternative methods of enabling cross-border data transfers, the report concludes an adequacy decision as the “least burdensome and most comprehensive” option in order to provide stability and certainty for businesses. It considers that the use of any alternative mechanisms to enable cross-border data flows would be “sub-optimal” in comparison to an adequacy decision. This is in particular the case given, for example, the standard contractual clause option is in the process of being legally challenged and other options may not be appropriate for smaller or consumer facing businesses.
4. It urges the Government to ensure that any transitional arrangements, which will almost certainly need to be negotiated, incorporate provisions for continued data sharing until such time as an adequacy decision has been awarded.
5. Finally, as the EU-US Privacy Shield and Umbrella will no longer apply to the UK post-Brexit, the UK may be required to show that it has arrangements in place with the US which offer at least the same level of protection. The report suggests a solution similar to that of Switzerland, which has negotiated a ‘Privacy Shield’ with the US and has been granted an adequacy decision from the EU.
Although the report is not binding, it is likely to result in a debate around the UK’s next steps in terms of the effect of Brexit on data protection regulation and lead to some clarity for UK businesses.
Beverley Flynn