July 10, 2018

The Committee says that the Government’s objective in the negotiations must be to maintain high standards of data protection and ensure that data can continue to be transferred across borders as it is now.

The Committee notes that the EU’s existing arrangements for providing for data flows with third countries typically involve a decision of adequacy from the European Commission.  The UK has asked for this to be on the basis of a two-way agreement in the form of a Treaty.  In the Committee’s view, the UK should provide more information on the distinction between the procedure for an adequacy decision and the procedure that it expects both parties to go through to secure an international agreement on data.

Further, according to the Committee, if the UK wishes the Information Commissioner to continue to be on the European Data Protection Board, the Government should accept that the CJEU will continue to have jurisdiction over aspects of data protection law in the UK after exiting the EU.

Essentially, the UK is seeking an unprecedented agreement, which will be subject to negotiation.  The Committee says that the UK Government should therefore be preparing for the adequacy process and ensuring that there is no risk of a gap in legal provision for transferring data between the UK and the EU after December 2020.  In fact, the UK Government needs to establish with the Commission whether it is possible for the adequacy process to be initiated before the UK leaves the EU and, if so, to initiate the process without delay.  Beyond this, the UK should explore the possibility of negotiating a bespoke agreement with the EU allowing much closer co-operation in data protection and data sharing, which once achieved, could replace the third party arrangements conferred by a simple adequacy decision.  To read the report in full, click here.