The Government has just six weeks to prevent UK businesses from being engulfed in yards of red tape and facing crippling costs of setting up complex data transfer contracts with EU countries before the Brexit transition period expires on December 31.
That is the stark conclusion of The Cost of Data Inadequacy report from UCL’s European Institute and the New Economics Foundation, which puts the initial cost of a failure to secure an adequacy agreement on data protection at up to £1.6bn, and potentially tens of billions more in lost revenues.
In the event of a no-deal Brexit, or a deal but then no adequacy decision, small and medium-sized firms will be disproportionately affected by the disruption. The average compliance cost estimated at £3,000 for micro, £10,000 for small, almost £20,000 for medium and about £163,000 for large businesses.
The cost of setting up alternative transfer deals, so-called standard contract clauses, can be similar to data protection impact assessments, the study shows, from £12,450 for a small scale one to £133,000 for large DPIAs.
Some sectors, such as medical research, could be more expensive, with the report quoting a cost of £100,000 for negotiating a single data-sharing agreement.
And, as well as the increased cost of doing business due to new compliance requirements, the research exposes other major issues, including greater risk of GDPR fines due to increased threats from privacy groups, a reduction in EU-UK trade and digital trade, reduced investment (both domestic and international) and the relocation of business functions, infrastructure, and staff to outside the UK.
The report says the costs of legal fees and bureaucracy would also deprive businesses of vital resources and investment in new technology, staff, and research at a critical time. Financial services, digital technology companies and data centres are likely to be worst hit.
The research draws on extensive interviews with legal professionals, business representatives, data protection officers and policy makers, from the UK and the EU.
One business contributor said: “It may be easier to just move out of London and open an office in Frankfurt or Dublin.” A technology business executive added: “Over time, EU companies will prefer to keep data in Europe.”
UCL European Institute research associate Oliver Patel said that in recent years, the European Court of Justice has taken a much tougher approach to restricting data transfers between the EU and other countries, much to the consternation of the business community.
He warned: “Post-Brexit, there is a risk that EU-UK data transfers could be targeted by activists and European courts, seeking to exploit the rigid EU rules in this area.”
New Economics Foundation senior researcher Duncan McCann concluded: “Failing to secure an adequacy decision will impose additional costs on UK organisations of over £1bn, disproportionality falling on SMEs, at a time when the economy is already severely challenged by the pandemic and trading conditions are difficult.
“A positive adequacy decision eliminates these costs, as well as others risks, and ensures that the UK remains an easy and attractive place for EU organisations to share data with, especially in data intensive sectors of the economy.”
UK industry chiefs call for ‘precious’ Brexit data deal
EU told to block UK data deal due to ICO’s dismal record
Data transfer red tape awaits as new Brexit blitz begins
Govt plans for EU data transfer deal branded ‘nonsense’
Adtech breach widens, two years after first complaints
Group seeks €10bn pay-out over adtech GDPR breach
Privacy groups hit out at fresh delay to adtech probe
CBI: No deal Brexit will rock data industry from day one
DMA issues dire warning over post-Brexit data transfers
Firms urged to set up their own EU data transfer deals
CBI calls for Brexit deal to protect £240bn data industry