Businesses have warned the UK’s £240bn data economy could be at risk unless a suitable Brexit transition deal is established by the Government.
Under EU regulations, businesses are only allowed to move data from within the bloc to countries outside of it if those countries meet the EU standards for data protection.
This is intended to stop corporations laundering data to jurisdictions where they could use it for purposes that would not be allowed in the EU.
Although, as part of the EU, the UK is currently compliant with EU data protection law, it will become a separate jurisdiction after Brexit and will require an “adequacy” agreement in terms of its data protection laws.
To meet these requirements the Government has introduced a Data Protection Bill, which will enshrine the EU’s new General Data Protection Regulations in UK law, but businesses are concerned this may not be enough.
Josh Hardie, deputy director-general of the Confederation of British Industry, said the bill shows the Government “has taken the right steps… but in the long-term, we need an ‘adequacy decision’ with the EU, where the UK can prove our data laws and business environment meet EU standards”.
“Unless the Brexit negotiations find another way, getting such a deal would mean first becoming a ‘third country’. In other words, we’d need to leave the EU before that process could even begin.”
The legal uncertainty of the UK being a “third country” would “affect jobs, growth and prosperity across the UK” he said.
“The last major data deal between the EU and a third country was with New Zealand and that took four years,” he added.
One of the most controversial adequacy agreements in recent years was made by the European Commission at the turn of the millennium, when it quickly asserted US legal principles complied with EU ones.
It stood by this decision even after Edward Snowden provided documentary evidence to the contrary, and would not concede the “Safe Harbor” arrangement was invalid until a legal challenge was escalated to the European Court of Justice.
Safe Harbor – the adequacy decision which allowed Facebook, Microsoft and others to transfer EU citizens’ data to the US – was declared void, and those data transfers became illegal overnight. However, they continued anyway.
Using contractual arrangements, US-based corporations continued to process EU citizens’ data while the commission quickly worked on putting together a new agreement.