Can we exhale yet? EU set to rule UK 'adequate' for data sharing in post-Brexit GDPR move The EU is set to rule that the UK's laws are sufficient to ensure "adequacy" for the safe sharing of personal data, a move promising to end uncertainty over data protection rules post-Brexit. Officially the UK left the umbrella of the EU's General Data Protection Regulation (GDPR) at the end of the Brexit transition period on …
The UK has relied on the EU-wide get-out of "national security" exceptions for member states for the likes of RIPA and similar spying laws. As a non-EU country that sort of exception no longer applies.
Remains to be seen if a challenge to our data sharing along the lines of the USA one will result in this (reported as happening) compliance decision being flipped.
As I understood the FT article this only applies to your average punter data, held by private companies etc. Let's say, Vodafone head office in the UK processing data from Italian customers for instance.
The UK has not been granted access to the Schengen Information System or the European Arrest Warrant data so police and other security operations will not enjoy data sharing. No more alerts about that chap that has just shown up at the passport control booth in Heathrow.
I also seriously wonder whether the latter is coming back. The UK has a bad reputation when it comes handling sensitive data or sticking to agreements (UK taking 'steps' after illegal copying of EU Schengen data) and I think Brexit is quite an easy way for the EU to never have to share sensitive data again.
(EU)-GDPR requires that a business cannot hand over data on EU citizens without a valid EU warrant or the written permission of the identifiable persons in the data.
As the UK is no longer an EU member state, it cannot issue an EU warrant, so companies handing over EU data under a UK warrant would be in breach of the EU-GDPR, if they didn't hand over the data, they would be in breach of UK law...
This is part of the problem with the USA, there are no exceptions for EU data and it has to be handed over if there is a US warrant, or even without a warrant under National Security Letter / FISA Court, CLOUD Act and the Patriot Act. The UK'S RIPA would also fall into this same category.
If the UK-GDPR complies with EU-GDPR and the issuing of a warrant in the UK requires similar levels of proof as in the EU, things will probably be okay. As the European Court of Justice has already sent RIPA back a couple of times as being unlawful, it could be a sticking point on what should otherwise be a formality. Otherwise, the UK will have to officially exclude EU data/communications from RIPA's remit.
The European Court of Justice has ultimate oversight for the Schengen Information System and European Arrest Warrant. Johnson wouldn't agree to be subject to it's decisions, it was one of the red lines in the negotiations, so the UK was not going to get real time access.
The incidents with the Police copying data from the Schengen database also undermine trust in the UK being able to maintain proper privacy controls on EU citizens data.
"The UK has a bad reputation when it comes handling sensitive data or sticking to agreements..."
Given how many times our, ah, "allies" and "partners" across the channel "forgot" to share information with us, I seriously doubt we will be the ones to come off worst if the EU gets bullish over sharing security information.
"Oh yes, we knew Mr X had a string of arrest warrants outstanding for assault and robbery in his home country but he is in the UK now, and we don't want him back."...
It's not necessarily about whether you have changed your regulations or think you are still compliant. It's all about whether your counter-party agrees.
Thankfully it sounds like they are agreeing because I can't begin to describe the omnishambles for some UK sectors if this adequacy had not been given. Not just tech startups, there are many sectors that rely on cross border data transfers, from billing and research to marketing and human resources. Large chunks of the service sector would have been affected as they could no longer handle data from customers in the EU.
For a while it looked like the recognition was only going to go one way. That means that any serious business model for all of Europe would mean moving data heavy operations to the EU and handling UK data from there. Imagine the exodus...
A cynical person might suggest this allows the commission to kick the toxic problem of UK "adequacy" down the road few years until the case gets to CJEU, allowing them to ignore this problem for a couple of years while they try to figure out rather more important details like how physical trade is going to work.
Of course, a bunch of EU politicians would never be that cynical, would they?
>So which bits of project reality aren't you personally seeing?
It's a bit hard to see anything when your head is stuck in the ground...
What we can learn from Brexit is that even if the UK does satisfy the 'adequacy' requirement, there will be a massive amount of forms to be completed (in English and French) for each and every data subject you wish to hold data on...
What isn't clear from Brexit is just how much of the non-tariff paperwork is required by the EU and how much is Westminster/Whitehall's creation.
@Roland6
"What we can learn from Brexit is that even if the UK does satisfy the 'adequacy' requirement, there will be a massive amount of forms to be completed (in English and French) for each and every data subject you wish to hold data on..."
Doesnt that show how bad an idea it would be to remain in the EU. If it is so difficult to do the paperwork and so difficult to trade with the EU then they are walling themselves off. And the EU is only a section of the world, one that is a shrinking portion of the worlds wealth. One that looks to be coming out of this virus crisis late again as they did with the financial crisis.
"What isn't clear from Brexit is just how much of the non-tariff paperwork is required by the EU and how much is Westminster/Whitehall's creation."
This is the bit to care about after brexit. The good news is talk of free ports and discussing joining a trade block. But reducing red tape in general is a good idea.
This post has been deleted by its author
@Glen 1
"They are walling *us* off from *their* money FTFY"
So if I elaborate on that- the EU is stopping the people within the EU from buying the services and products they want from the UK by walling us off? That sounds a stupid thing to do doesnt it? Sounds harmful to their population.
Apply the same to the UK. Would you suggest we wall off the world so we buy British? How well does that turn out (look to UK history)? That sounds a lot like the nationalist approach remainers accused brexit of.
@codejunky - That's some weird logic.
>Doesnt that show how bad an idea it would be to remain in the EU.
What is shows is just how stupid the UK was to rip up existing trade agreements in the form of its membership of the Single Market and Customs Union.
>But reducing red tape in general is a good idea.
On that measure, Brexit looks like an own goal.
@Roland6
"What is shows is just how stupid the UK was to rip up existing trade agreements in the form of its membership of the Single Market and Customs Union."
How? According to you (as I replied) it is difficult to trade with the EU due to all the forms (in English and French). When we were in the EU that means it was that difficult for the world to trade with us because we were inflicting that EU paperwork.
If EU paperwork is bad then we are right to leave and get rid of it. That way we can trade with the rest of the world easier.
"On that measure, Brexit looks like an own goal."
How? We are only recently out and already looking to international trade and setting up freeports.
"That's some weird logic."
Its consistent. Interestingly this trade issue has been regularly brought up and through my post history I have been saying it for years. Yet I was regularly told it isnt hard to trade with the EU from outside the EU, only to now be told that it is hard and so as a brexiter I was proved wrong.
If trade with the EU is so difficult do we want to be inside and cut off from the world, or in the world and the EU can wall itself off? I dont know of many successful walled off economies.
@codejunky
You'll find that many countries have trade agreements with the EU in which many non-tariff barriers such as regulatory equivalence, will have been addressed. Remember it was the UK who want out to be totally out and so didn't want regulatory equivalence etc. fundamentally it is the UK Government who has made things difficult.
You should be thankful that many countries are still prepared to trade with the UK on the same terms as they did with the EU28, falling back to WTO for all our trade would make the current situation look good.
Expect GDPR to be similar, the UK Government will say that it do abc to the EU whilst at the same time tell its suporters that it will do xyz which contradict its abc commitments...
@Roland6
"You'll find that many countries have trade agreements with the EU in which many non-tariff barriers such as regulatory equivalence, will have been addressed."
Ok. So the EU is hard to trade with. To get around this the EU have made trade agreements looking after the protectionist interests of the member countries to some countries in the world. Because its hard to trade with.
"Remember it was the UK who want out to be totally out and so didn't want regulatory equivalence etc. fundamentally it is the UK Government who has made things difficult."
Why would we want regulatory equivalence? And why would we want to be walled off from the world with the only excuse being trade deals with some countries that are protectionist for the various members of the EU? Instead we ditch their over-regulated insanity, make it easy to trade with us and have that competitive advantage the EU feared we would have. In the EU presidents words we would be a speedboat and them a supertanker.
"Expect GDPR to be similar, the UK Government will say that it do abc to the EU whilst at the same time tell its suporters that it will do xyz which contradict its abc commitments..."
That sounds like dealing with the EU. Say one thing and do something different. And why not treat them as they treat us?
>Ok. So the EU is hard to trade with. To get around this the EU have made trade agreements looking after the protectionist interests of the member countries to some countries in the world. Because its hard to trade with.
Well, if the UK was so 'open' etc. there would be no need for countries to sign trade treaties with the UK that were equivalent to the ones they have with the EU...
I think you need to educate yourself on the trade barriers the UK has created...
>Why would we want regulatory equivalence?
To avoid non-tariff barriers. So that for example a BSI kitemark means something in another country...
@Roland6
"Well, if the UK was so 'open' etc. there would be no need for countries to sign trade treaties with the UK that were equivalent to the ones they have with the EU..."
I dont disagree. So we are in month 2 of officially being out of the EU and their rules. Month 2. Our starting point as of the 1st jan is to be stuck with all those rules the EU had us enforce for a couple of decades.
So as I said we need to be looking to burn the walls stopping trade. Something the EU was openly concerned about because it gives us a competitive advantage.
"I think you need to educate yourself on the trade barriers the UK has created..."
We couldnt because we had to follow the diktat of the EU. Their barriers. And if you dont like them they need to be the next thing we vote for change.
"To avoid non-tariff barriers. So that for example a BSI kitemark means something in another country..."
What a terrible idea. Should we regulatory align to the US? I am sure that will have a good number of remainers crying. How about China? India? Exports must meet the standards of the importing country. Imposing those on the domestic economy is stupid. We are the UK, not anywhere else.
>What a terrible idea. Should we regulatory align to the US?
Well Boris is still negotiating a new agreement with the US and given his government is trying to prevent Parliament from having any meaningful say or veto over whatever he agrees...
>Exports must meet the standards of the importing country.
I think you missed the point, I was making. Previously, a UK company could have products intended for export tested by the BSI et al and for the receiving country to accept the BSI testing as equivalent to its own testing service. Without this equivalence, the UK company has to submit product to
the testing organizations recognized by each individual country they wish to export to.
Remember regulatory equivalence also includes such basic things as weights and measures.
@Roland6
"Well Boris is still negotiating a new agreement with the US and given his government is trying to prevent Parliament from having any meaningful say or veto over whatever he agrees..."
I am not sure that answers or responds to what you quoted- What a terrible idea. Should we regulatory align to the US?. A trade agreement is not regulatory alignment. We have our domestic policies, we are not giving political control of our country to a foreign government.
"Without this equivalence, the UK company has to submit product to the testing organizations recognized by each individual country they wish to export to."
So UK exports would have to meet the standards of the importing country? Which is how trade is done worldwide. While our imports will be set to the UK standards looking after the UK's interests instead of protecting the 27 other economies to our detriment.
The world continues trading. And while the EU might insist on cutting itself off (as your comments suggest) then we are better off in the world surely.
"the European Commission is set to allow data to continue to flow freely from the EU to the UK after concluding that the British had ensured an adequate level of protection"
This despite almost universal non-compliance with the Regulation. The law may be fine, but if nobody bothers to comply or enforce, what's the reality? And if this decision goes though, why should any business bother to comply?
The only losers are the data subjects - you and me.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
