29/08/2017
A model drawing on the ‘adequacy’ decision used by the EU to assess whether a 3rd country’s data protection rules are adequate is suggested by the UK as the basis of a mechanism for supervising the cross-border exchange and protection of personal data post Brexit.
Personal data flows are vital to the UK and EU economies and also to the two parties’ wider cooperation on law enforcement and other matters. ‘The exchange and protection of personal data – a future partnership paper’ presents the UK’s proposals for the protections that must be in place to enable this.
The value of the EU data economy was estimated at €272 billion in 2015, while further estimates suggest this could increase to €643 billion by 2020. 75% of the UK’s cross-border data flows are with EU countries and analysis indicates it has the largest internet economy as a percentage of GDP of all the G20 countries.
The UK accounted for 11.5 per cent of global cross-border data flows in 2015, compared with 3.9 per cent of global GDP and 0.9 per cent of global population. The value of data flows to the whole economy and the whole of society are greater still.
In the UK-EU model outlined in the position paper, the UK would demonstrate its compliance with EU data protection law by introducing a Data Protection Bill that would, among other things, implement the
- General Data Protection Regulation (GDPR), which covers general processing of personal data within the scope of EU law
- Data Protection Directive (DPD), which relates to personal data being processed for law enforcement purposes
By building on the existing adequacy decision, this model could achieve key objectives such as
- maintaining the free flow of personal data between the UK and the EU
- offering stability and confidence
- providing for ongoing regulatory cooperation between the EU and the UK
- continuing to protect the privacy of individuals
- respecting UK sovereignty
- imposing no unnecessary additional costs on business