27 August 2019

UCL European Institute: Brexit could cause major disruption to EU-UK data flows

UK businesses could be in for a huge headache if the government fails to secure an agreement on data flows between the EU and the UK post-Brexit, according to a new report published by UCL European Institute.

The report ‘EU-UK Data Flows, Brexit and No-Deal: Adequacy or Disarray’, outlines the kinds of bureaucracy that businesses might face in the case of no-deal Brexit, which includes having to invest in legal and administrative fees to ensure EU-UK data transfers remained lawful.

“There has been intense political focus on the issue of trade in goods, particularly in regards to the border with Ireland. By comparison, issues relating to data flows and trade in services more broadly have been neglected. This is despite the fact that services comprise 80% of the UK economy, and disruption to EU-UK data flows could be as economically damaging as disruption to trade in goods,” said Research Associate and co-author of the report, Oliver Patel (UCL European Institute).

The report outlines the EU’s legal and policy approach to data protection, providing an overview of the General Data Protection Regulation (GDPR) and the EU data governance framework. It highlights EU-third country data relationships, including for EEA countries and ranging from those with a full data agreement to countries where there is no formal arrangement. [...]

The only way data flows can remain seamless post-Brexit is if the EU issues an ‘adequacy decision’, which is a tool for assessing data protection rules in non-EU countries and deciding whether they meet EU standards.

The researchers outline three possible ‘no-deal on data flows’ scenarios which would leave the UK without an adequacy decision: 1) No Withdrawal Agreement: ‘cliff edge’ Brexit;
2) Withdrawal Agreement but no adequacy decision; 3) Adequacy decision after the transition period ends.

 

The report highlights that there is no guarantee of the UK being given a positive adequacy agreement, due to concerns raised by EU officials about the UK’s surveillance and national security practices. The general view from the EU is that post-Brexit the UK will be treated as a ‘third country’, whereby they would be expected to follow stringent requirements. [...]

Full report

© UCL European Institute