This site would like to set some non-essential temporary cookies. Some cookies we use are essential to make our site work.
Others such as Google Analytics help us to improve the site or provide additional but non-essential features to you.
No behavioural or tracking cookies are used.
To change your consent settings, read about the cookies we set and your privacy, please see our Privacy Policy

Digital Business Lawyer

The UK seeks accelerated adequacy finding to maintain data flows with EU

The UK Government published its proposals for a shared approach to data protection with the EU post-Brexit on 24 August 2017, in its Policy Paper entitled ‘The exchange and protection of personal data - a future partnership paper.’ The UK Government’s Department for Exiting the European Union published the Partnership Paper, stating that it is essential that a UK-EU model for protecting and exchanging personal data is agreed, which allows for the free flow of data to continue between the EU and UK, and which provides certainty for businesses.

The Partnership Paper makes it clear that data protection is a priority issue for the UK and that the UK’s data protection framework will be aligned with Europe’s data protection laws, which includes adoption of the General Data Protection Regulation (‘GDPR’), at the point of Brexit in order to ensure the free flow of data between Europe and the UK, which is vital for the digital economy. The Partnership Paper confirms the Government’s intention to seek an ‘adequacy decision’ from the European Commission in order to maintain the free flow of personal data from Europe to the UK and urges the EU to confirm before Brexit occurs that the UK will have preliminary adequacy status.

“The UK Government rightly points out that there is regulatory uncertainty surrounding the UK’s position with respect to data transfers. Once Brexit occurs any transfers from the EU to the UK will be to a third country. Businesses need to be reassured that such transfers can still occur without having to deal with costly and onerous alternatives, the UK Government argues,” explains Victoria Hordern, Counsel at Hogan Lovells International LLP. “In effect the UK Government is seeking an accelerated adequacy finding on the basis of the UK’s unique status as a close trading partner with the EU and as a soon to be former EU Member State that will be incorporating the GDPR into its law.”

The EU Home Affairs Sub-Committee of the UK House of Lords issued a report in July called ‘Brexit: the EU data protection package,’ which criticised the lack of detail on how the UK Government planned to deliver its objective of maintaining unhindered data flows with the EU. The Government has now provided clarity on its preferred approach to maintaining such data transfers post-Brexit.

“The main benefit to UK businesses is that adequacy recognition would enable lawful data flows from the 27 EU Member States to the UK to continue without pause, on an overarching basis. This would avoid the need for additional data flow specific agreements with their related costs. If successful, the proposal would allow the UK to remain a trusted EU partner for personal data, granting an extension of the current ‘safe zone’ for data protection, with corresponding reputational benefits for businesses in the UK. Building on this strong basis, the UK could more easily continue to grow its critical digital economy,” said Liz Fitzsimons, Partner at Eversheds Sutherland.

The UK Government also issued its policy paper on ‘Enforcement and dispute resolution - a future partnership paper’ on 23 August 2017, which confirms that the direct jurisdiction of the Court of Justice of the European Union (‘CJEU’) in the UK will end at the point of withdrawal from the EU. The UK and the EU will therefore need to agree on how both the provisions of the Withdrawal Agreement, and the new partnership, can be monitored and implemented, and how any disputes which arise can be resolved, explains the Partnership Paper.

The Government outlines scenarios under which the CJEU is replaced by a joint committee or an arbitration panel as the new dispute resolution mechanism.

“An interesting debate around the adequacy solution for EU-UK transfers will be the extent to which the UK is expected to continue to submit to CJEU jurisdiction for resolution of personal data law disputes, especially as data protection also involves protection of a number of critical European Charter Fundamental Rights and in particular where the rights of EU citizens are at stake. The Government has previously confirmed that CJEU decisions pre-Brexit will become domestic UK law, with subsequent decisions being persuasive. Any data transfer deal with the UK risks challenge to the CJEU and it is not a given that it will be accepted. Witness the recent rejection by the CJEU of the proposed EU-Canada PNR transfer agreement,” concludes Fitzsimons. “The reality is that under the GDPR, aggrieved data subjects in the 27 European Member States may bring complaints locally for their domestic courts to resolve, which will involve a right of appeal to the CJEU, making its jurisdiction hard for the UK to ignore in reality.”

Search Publication Archives

Our publication archives contain all of our articles, dating back to 1999.
Can’t find what you are looking for?
Try an Advanced Search

Log in to digital business lawyer
Subscribe to digital business lawyer
Register for a Free Trial to digital business lawyer
digital business lawyer Pricing

Social Media

Follow digital business lawyer on Twitterdigital business lawyer on LinkedIndigital business lawyer RSS Feed