Companies have been urged to brace themselves for a post-Brexit “no deal” on data transfers despite Brussels and London agreeing an extension of up to six months to secure a data adequacy agreement to allow for the continued free flow of personal data between the UK and EU.
It is estimated that £85bn of UK exports are reliant on exchanging data with the EU; without an adequacy deal, UK firms will still be able to transfer data to EU business, but companies in Europe will not be able to send data to the UK as Britain will be classed as a “third country” without adequate data protection laws.
This issue was first exposed even before the Brexit vote and the CBI went on to argue that without a deal the UK’s £240bn data economy would fall “off a cliff edge”. Even then, back in 2017, the organisation recognised the protracted nature of such negotiations and called for an interim deal.
The quickest adequacy decision took 18 months to finalise, while the most recent one, signed with Japan, took years to complete and saw Tokyo join just 12 countries, including Argentina, Israel, and New Zealand, which have similar deals with the EU.
And the extension, included in the EU–UK Trade & Cooperation Agreement signed just before the New Year, means there is still no guarantee that data flows will continue after June.
Even so, Information Commissioner Elizabeth Denham is decidedly upbeat. She said: “This is the best possible outcome for UK organisations processing personal data from the EU.
“This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices.
“We will be updating the ICO guidance on our website to reflect the extended provisions and ensure businesses know what happens next. At this stage it’s good news for businesses and public bodies.”
Meanwhile TechUK CEO Julian David added: “TechUK and the wider tech sector have been highlighting the importance of a data adequacy agreement since the day after the 2016 referendum.
“Data adequacy is so important, not just because of the economic costs of failing to reach an agreement, estimated to be around £1.6bn to the UK economy, but because of the high level of integration between UK and EU tech companies.
“It is vital that the UK Government and European Commission work at speed to finalise the process in order to give businesses certainty and to allow the UK to move on to a new phase of collaboration with industry and stakeholders in the development of data policies that support high standards and the innovative use of data to improve public services and the growth of the tech sector.
“The bridging period will also allow the UK Government to work with the sector to finalise any new tools available to UK companies that will complement a data adequacy agreement with the EU to support access to global data flows.”
However, DMA head of public affairs Michael Sturrock warned: “We still can’t say an adequacy deal is likely, as recent developments would suggest. Therefore, in spite of the new extension, you must prepare your business for the chance of a no deal on data by June 2021.
“The DMA has put enormous effort in over the last several years to impress upon the Government how serious the issue is for the success of the data and marketing industry. We will continue to push hard to ensure the industry’s interests are heeded in the weeks and months ahead.”
Firms face £1.6bn hit within weeks with no EU data deal
UK industry chiefs call for ‘precious’ Brexit data deal
EU told to block UK data deal due to ICO’s dismal record
Data transfer red tape awaits as new Brexit blitz begins
Govt plans for EU data transfer deal branded ‘nonsense’
Adtech breach widens, two years after first complaints
Group seeks €10bn pay-out over adtech GDPR breach
Privacy groups hit out at fresh delay to adtech probe
CBI: No deal Brexit will rock data industry from day one
DMA issues dire warning over post-Brexit data transfers
Firms urged to set up their own EU data transfer deals
CBI calls for Brexit deal to protect £240bn data industry