Brexit could cause major disruption to EU-UK data flows

The report ‘EU-UK Data Flows, Brexit and No-Deal: Adequacy or Disarray’, outlines the kinds of bureaucracy that businesses might face in the case of no-deal Brexit, which includes having to invest in legal and administrative fees to ensure EU-UK data transfers remained lawful.

“There has been intense political focus on the issue of trade in goods, particularly in regards to the border with Ireland. By comparison, issues relating to data flows and trade in services more broadly have been neglected. This is despite the fact that services comprise 80% of the UK economy, and disruption to EU-UK data flows could be as economically damaging as disruption to trade in goods,” said Research Associate and co-author of the report, Oliver Patel (UCL European Institute).

The report outlines the EU’s legal and policy approach to data protection, providing an overview of the General Data Protection Regulation (GDPR) and the EU data governance framework. It highlights EU-third country data relationships, including for EEA countries and ranging from those with a full data agreement to countries where there is no formal arrangement. 

The findings are based on interviews that the researchers carried out with over 50 people including EU and UK politicians, civil servants, ambassadors, regulators, lawyers, business leaders and policy professionals between 2017 and 2019.

Personal data flows freely between the EU and the UK, and it has done since the emergence of the modern internet and digital economy. The free flow of data within the EU is enabled by harmonised data protection rules and common systems of regulatory enforcement. EU Member States also have shared arrangements for data flows with non-EU (i.e. third) countries.

The only way data flows can remain seamless post-Brexit is if the EU issues an ‘adequacy decision’, which is a tool for assessing data protection rules in non-EU countries and deciding whether they meet EU standards.

The researchers outline three possible ‘no-deal on data flows’ scenarios which would leave the UK without an adequacy decision: 1) No Withdrawal Agreement: ‘cliff edge’ Brexit;
2) Withdrawal Agreement but no adequacy decision; 3) Adequacy decision after the transition period ends.

The report highlights that there is no guarantee of the UK being given a positive adequacy agreement, due to concerns raised by EU officials about the UK’s surveillance and national security practices. The general view from the EU is that post-Brexit the UK will be treated as a ‘third country’, whereby they would be expected to follow stringent requirements.

“The UK wants to go beyond ‘adequacy’ for its data relationship with the EU. However, there is a risk that it might not even get a positive adequacy decision,” Patel said.

“Three-quarters of the UK’s international data flows are with the EU, and much UK economic activity is dependent on these flows. Disruption – particularly in the case of a no-deal Brexit would place immense compliance burdens on businesses,” he concluded.

Links

• UCL European Institute
• EU-UK Data Flows, Brexit and No-Deal: Adequacy or Disarray

Image

• London. Credit: Fernando García Redondo, Source: Flickr

Media contact

Natasha Downes

tel: +44 20 3108 3844

E: n.downes [at] ucl.ac.uk