CBI: No deal Brexit will rock data industry from day one

The UK’s mantle as a global hub for data flows is at significant risk from a no deal Brexit, with burgeoning legal costs, interrupted data flows and reduced investment in data centres that beginning on “day one” – November 1.
That is the damning prediction from the CBI, in its new report entitled “What Comes Next? The Business Analysis Of No Deal Preparations”, based on thousands of interviews with firms of all sizes and sectors, including 50 trade associations, covering all areas of the UK economy.
As far back as September 2017, the so-called “bosses union” called for an interim deal on data protection and data-flows to prevent the UK’s £240bn data economy falling off a cliff edge.
However, in its new report, the CBI has warned the Government that neither the UK nor the EU is ready for a no-deal Brexit on October 31. The risk of no deal on data has meant UK companies have already undertaken costly legal processes to update existing contracts, led some UK firms to shift jobs abroad in data-intensive areas such as HR, and seen investment in data centres in EU countries in place of UK ones.
In a no deal scenario, UK firms will still be able to send data to EU countries but will not be able to receive data from member states.
The CBI insists that while the effect of no deal on data will be invisible compared to the disruption at ports, as it will be experienced in offices and legal departments, it will be no less impactful, with the worst-case scenario of UK companies losing contracts with EU customers who no longer wish to deal with UK partners.
It cites as an example, a UK conference centre which might lose bookings from EU companies that would be in breach of personal data rules if they sent attendees’ data outside of the EU without the right contractual safeguards. There is a risk of litigation to prevent data flows being made to the UK, even if European companies have updated their contracts.
While the Information Commissioner’s Office has released some guidance for companies in the event of a no deal, even this could be blown out of the water by legal action being taken by Facebook nemesis and privacy campaigner Max Schrems, which he started in 2016.
If the European Court of Justice rules in Schrems’ favour that standard contractual clauses are illegal, the options to ensure the free flow of personal data between the EU and UK will be drastically reduced.
One of the key recommendations from the CBI is that the Government must launch a public awareness campaign ahead of the “Halloween” Brexit deadline to target SME companies that are unprepared.
It also wants the Government to begin preparations to immediately request an adequacy agreement on data. However, the quickest adequacy decision took 18 months to finalise.
The most recent one, signed with Japan, took years to complete and saw Tokyo join just 12 countries, including Argentina, Israel, and New Zealand, which have similar deals with the EU.
So far, the UK and EU have taken no joint action on no deal preparations for data transfers, but Brussels has dug its heels in on a number of key issues.
• The UK will be treated as a third country in no deal, explicitly outlining that EU companies will be in breach of EU law if they export personal data into the UK without sufficient legal provisions.
• Companies in the UK importing personal data from the EU will be required to introduce additional clauses into legal agreements.
• UK firms whose lead supervisory authority is the ICO will no longer benefit from the one-stop-shop mechanism, that currently allows firms to work with only one authority to transfer data across the EU. This means firms will likely need to engage with multiple EU supervisory authorities
• UK businesses without an office in the EU but offering goods and services to, or monitoring the behaviour of, EU individuals will need to appoint an EU representative responsible for GDPR compliance and a point of contact for European citizens.
The report concludes: “The UK Government must ramp up its preparation to ensure SMEs are aware of the impact of no deal on data. In a no deal situation, until an adequacy decision is reached, the UK’s digital economy will be less competitive in a fast-growing global market.
“Achieving an adequacy decision with the EU Commission will be vital for the UK. The UK has unprecedented alignment with the EU on data protection standards and the ICO is internationally renowned regulator which will support the UK’s negotiating case.
“Yet gaining an adequacy agreement following a no deal scenario is likely to take more than a year. As a third country, the UK’s national security legislation – in particular, the Investigatory Powers Act – will be heavily scrutinised for its compatibility with the GDPR, potentially lengthening the uncertainty.”
Speaking to the BBC’s Today programme, CBI’s deputy director general Josh Hardie said: “A deal is absolutely essential if we’re to manage the economy in the best way that we can.”
Talking about a no deal, Hardie added: “If you see a storm coming, you put down the sandbags. It doesn’t mean you’re going to stop all the flood water, you’ll probably still lose the kitchen but you might save the bedroom and that’s where we are right now.”
He said meetings between businesses and the government needed to “scale up – and they have to scale up now”. He said that talks about no-deal preparations had been postponed since an initial March deadline to leave the EU was delayed until October 31.
A UK Government spokesperson said: “This is a constructive contribution from the CBI, acknowledging the importance of all businesses preparing for no deal, [however] we have done more to prepare than this report implies.
“This includes funding for a major nationwide communications campaign to ensure that people and businesses are ready.”