Can we exhale yet? EU set to rule UK 'adequate' for data sharing in post-Brexit GDPR move
- Reference: 1613399352
- News link: https://www.theregister.co.uk/2021/02/15/uk_gdpr_adequacy/
- Source link:
Officially the UK left the umbrella of the EU's General Data Protection Regulation (GDPR) at the end of the Brexit transition period on 31 December 2020. The UK had been afforded a six-month grace period (until 1 July 2021), which meant that, in practical terms, the rules still applied to the UK and organisations complying with the rules could continue to share data between the UK and EU nations, [1]although businesses were advised to put additional safeguards in place .
[2]
As UK breaks away from Europe, Facebook tells Brits: You'll all be Californians soon [3]READ MORE
The UK's Data Protection Act 2018, which as some readers might remember was the vehicle by which the GDPR was implemented when the UK was a member state, was amended on 1 January 2021 to be read in conjunction with the new "UK-GDPR" instead of the EU GDPR. The UK GDPR has not (yet) significantly diverged from the EU GDPR. For those interested, the [4]Keeling Schedules are here .
[5]
According to [6]the Financial Times , the European Commission is set to allow data to continue to flow freely from the EU to the UK after concluding that the British had ensured an adequate level of protection for personal information.
An EU decision in the affirmative would mean it had determined that the UK data rules set out in the December's [7]National Data Strategy – effectively a statement of intent – were sufficiently aligned with GDPR to allow the uninterrupted transfer of personal data from the EU to the UK.
The European Data Protection Board is set to scrutinise the decision before it is implemented, but the body responsible for overseeing and advising on legislation does not have the power to block the commission's decision. Such a decision of "adequacy" in the relationship with EU data law is said to be important to the UK working as a successful digital economy.
In the lead-up to the UK's practical departure from the EU trading arrangements, there had been concerns [8]that the UK's move to allow ministers to change data protection rules without going through Parliament might prompt the EU to place restrictions on data transfer to the UK.
[9]
For now, those fears seem unfounded. But the ultimate test would come if someone is prepared to bring a case, as Austrian privacy activist Max Schrems did with the Privacy Shield data-sharing arrangement between the EU and US. The European Court of Justice [10]struck down that arrangement in July last year. ®
Get our [11]Tech Resources
[1] https://www.lexology.com/library/detail.aspx?g=86b6534f-4c4b-4ddd-94e1-50fed5c1b72b
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_business/policy&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YCqoseDU@W1hp8DLx2jtgAAAAAM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2020/12/16/facebook_uk_users/
[4] https://www.gov.uk/government/publications/data-protection-law-eu-exit#history
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_business/policy&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YCqoseDU@W1hp8DLx2jtgAAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.ft.com/content/43ed5e0a-7b0a-40db-800f-6f3b9c58b9a8
[7] https://www.gov.uk/government/publications/uk-national-data-strategy/national-data-strategy
[8] https://www.theregister.com/2020/09/29/uk_data_adequacy_brexit/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_business/policy&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YCqoseDU@W1hp8DLx2jtgAAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/
[11] https://whitepapers.theregister.com/
Re: If UK data rules have not changed ...
The UK has relied on the EU-wide get-out of "national security" exceptions for member states for the likes of RIPA and similar spying laws. As a non-EU country that sort of exception no longer applies.
Remains to be seen if a challenge to our data sharing along the lines of the USA one will result in this (reported as happening) compliance decision being flipped.
Re: If UK data rules have not changed ...
As I understood the FT article this only applies to your average punter data, held by private companies etc. Let's say, Vodafone head office in the UK processing data from Italian customers for instance.
The UK has not been granted access to the Schengen Information System or the European Arrest Warrant data so police and other security operations will not enjoy data sharing. No more alerts about that chap that has just shown up at the passport control booth in Heathrow.
I also seriously wonder whether the latter is coming back. The UK has a bad reputation when it comes handling sensitive data or sticking to agreements ( [1]UK taking 'steps' after illegal copying of EU Schengen data ) and I think Brexit is quite an easy way for the EU to never have to share sensitive data again.
[1] https://euobserver.com/justice/145530
Re: If UK data rules have not changed ...
It's not necessarily about whether you have changed your regulations or think you are still compliant. It's all about whether your counter-party agrees.
Thankfully it sounds like they are agreeing because I can't begin to describe the omnishambles for some UK sectors if this adequacy had not been given. Not just tech startups, there are many sectors that rely on cross border data transfers, from billing and research to marketing and human resources. Large chunks of the service sector would have been affected as they could no longer handle data from customers in the EU.
For a while it looked like the recognition was only going to go one way. That means that any serious business model for all of Europe would mean moving data heavy operations to the EU and handling UK data from there. Imagine the exodus...
curious to see
How the UK signing up to the CLOUD act with the US and the rejection of the EU on the same can be reconciled.
If UK data rules have not changed ...
then should it be a surprise that the UK is still GDPR compliant ?
Or am I missing something ?