9Trade deals and data flows between the EU and third countries
|
Committee’s assessment |
Legally and politically important |
|
Cleared from scrutiny (debate in European Committee B on 23/10/2018); drawn to the attention of the Digital, Culture, Media and Sport Committee, the International Trade Committee, the Science and Technology Committee, the Business, Energy and Industrial Strategy Committee and the Exiting the EU Committee |
|
|
Document details |
(a) Communication from the Commission to the European Parliament and the Council on Exchanging and Protecting Personal Data in a Globalised World; (b) EU proposal for provisions on cross-border data flows and protection of personal data and privacy |
|
Legal base |
— |
|
Department |
Digital, Culture, Media and Sport and International Trade |
|
Document Numbers |
(a) (38493), 5191/17, COM(17) 7; (b) (40020),— |
Summary and Committee’s conclusions
9.1Document (a), a Commission Communication, is significant in highlighting the future approach of the EU to the exchange of personal data with third countries in a way which adequately protects EU citizens. It is highly relevant to the UK’s position either at a negotiated or non-negotiated exit.56 The background to the Communication and a detailed summary of its content are set out in our Report of 8 March 2017.
9.2The Communication points to adequacy decisions as the best option for a third country to share data with the EU, though it also refers to international data-sharing agreements in certain contexts (e.g. data-sharing in some JHA areas). A data adequacy decision57 takes the form of a Commission implementing decision, as specified by the General Data Protection Regulation (GDPR).58 Although subject to comitology procedure, meaning that the Commission is assisted by a committee of national experts when refining the measure before adoption,59 it is essentially a unilateral decision by the Commission which the Commission can repeal, amend or suspend.60
9.3In our last Report we sought reassurance from the Government that alternative methods of data exchange with the EU would be sufficient for UK businesses and stakeholders, given that a “no deal” outcome to the exit negotiations increasingly seems possible. We refer here to the Commission’s “Notice to Stakeholders” which highlights those alternative mechanisms: Standard data protection clauses61 binding corporate rules,62 Approved Codes of Conduct63 and approved certification mechanisms. The day following our last Report of 12 September, the Government published its ‘no deal’ notice. Also relevant to the data issues in this Chapter, is the European Commission’s Communication on Contingency Planning.
9.4The purpose of the proposal (document (b)) is to set out horizontal provisions for cross-border data flows and for personal data protection in EU trade negotiations. These were intended to be first deployed in trade negotiations with Indonesia but might change during those negotiations. As we reported on 12 September, the Government told us that they do not provide an alternative legal basis for the cross-border transfer of personal data, which is governed by the GDPR and Law Enforcement Directive (EU) 2016/680. While the Government considered that there were no immediate exit implications of the proposed provisions, it acknowledged that the Commission had stated the provisions would be a model for future FTA negotiations. Therefore, there are potential implications for the UK’s future relationship with the EU.
9.5We recommended both documents for debate on the floor of the House because of their potential importance to Brexit. The Government scheduled the debate instead in European Committee B for 23 October. Following the debate, which was of an exceptionally short duration, we wrote to the Government on 14 November requesting outstanding responses to questions in our Report of 12 September. The Government has now responded with their letter of 24 January, together with a detailed 15 page annex.
9.6We thank the Minister for Digital and the Creative Industries (Margot James MP) and the Minister of State for Trade Policy (George Hollingbery MP) for their letter and the comprehensive annex attached.
9.7These documents have already been cleared from scrutiny following the debate in European Committee B on 23 October. However, given the importance of data issues in the event of both a “no deal” or “deal” scenario, we draw to the attention of the House the Government’s further responses to our scrutiny questions and questions in the debate. In particular, we draw these documents and this chapter to the attention of the Digital, Culture, Media and Sport Committee, the International Trade Committee, the Science and Technology Committee, the Business, Energy and Industrial Strategy Committee and the Exiting the EU Committee.
9.8In doing so, we see little point in summarising all of the Government’s responses here as they can be accessed in full in the annex to the Ministers’ letter. From the repetitive nature of some of the responses received, we also consider that there is little to be gained from further protracted scrutiny or correspondence with the Government on either the Communication or the proposed horizontal data clauses. But we think it might be useful to highlight some key statements made. Although some are readily available from other published documents, they are worth marshalling into “no deal” and “deal” categories to get a better picture of the overall implications.
Responses relevant to a ‘no deal’ scenario
- In their 13 November Communication, the European Commission has said that the adoption of an Adequacy Decision is not part of their contingency planning for a ‘no deal’ scenario in March 2019.
- There would be no immediate change to the UK’s data protection standards. The Data Protection Act 2018 will remain in place and the GDPR will be incorporated in UK domestic law by the EU (Withdrawal) Act 2018 (EUWA). Secondary legislation was laid using powers under the EUWA to correct deficiencies in the General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA) resulting from the UK leaving the EU. This maintains the data protection standards of the GDPR and the DPA 2018 but transfers a number of functions conferred on the EU Commission by the GDPR to the Secretary of State. It also makes further transitional, transitory and saving provisions, so that the use of standard contractual clauses that have previously been issued by the EU Commission will continue to be an effective basis for international data transfers from the UK to third countries after exit day.
- The Government’s 28 November 2018 paper on the long-term economic analysis of EU exit looked at the impact of non-tariff barriers to trade including data protection regulation. The cost to businesses will vary depending on the size of the organisation and the nature of the personal data being processed and the type of contract in question. The Government expects most businesses will use be able to use Standard Contractual Clauses in the event of a no deal Brexit
- In proceedings pending in the European Court of Justice (CJEU) on the validity of Standard Contractual Clauses, Data Protection Commissioner v. Facebook Ireland Ltd and others (the Schrems II case),64 the Government has submitted written observations. It is of the view that the Commission Decisions which set out approved Standard Contractual Clauses (SCC’s) under which personal data may be transferred to a third non-EEA country, are valid and do not violate the rights of data subjects under Directive 95/46/EC (the predecessor to the GDPR) and the Charter of Fundamental Rights.
- In recognition of the unprecedented degree of alignment between the UK and EU’s data protection regimes at the point of exit, the UK does not intend to impose additional requirements on transfers of data from the UK to the EU.
- The UK will also preserve the effect of existing EU adequacy decisions with 12 non-EEA states on a transitional basis.
Responses relevant to a ‘deal’ scenario
- EU law will continue to apply to data transferred during the transition/implementation period (TIP) until adequacy decisions are granted to the UK, after which time it will be governed by UK domestic law.
- Related to this, the Political Declaration states that the EU will begin its assessment of the UK as soon as possible after the UK’s withdrawal, endeavouring to adopt adequacy decisions by the end of the TIP.
- The UK being a party to the updated Council of Europe Personal Data Convention 108 will be looked on favourably by the European Commission in any consideration as to the future arrangement for EU-UK personal data flows.
- The Government appears not to be ruling out a future data-sharing Treaty which goes beyond adequacy, in terms of an EU-UK future relationship on data. It repeats in response to questions about this that “The form and vehicle for such arrangements … is a matter for future negotiations.”
- The Government continues to maintain that as part of the negotiations on the future relationship, the UK will explore with the EU the terms on which the UK could remain part of relevant EU bodies. This would mean abiding by the rules of those bodies and respecting the remit of the CJEU. The Government adds that the UK Parliament would remain ultimately sovereign, and so could in principle decide not to accept these rules, but with consequences for UK membership of the relevant body.
- Provisions on data in existing FTAs refer to all data flows, not just personal data flows. The EU’s horizontal clauses do not provide a legal basis for personal data flows; they simply state an aim to remove barriers to data flows, insofar as compatible with EU data protection law, and respecting domestic data protection regimes. The Government’s ambition is to include substantive provisions on data clauses in the UK’s future economic partnership. However, it is a priority to have an adequacy decision in place to ensure data flows continue between EU-UK and so will factor this process into the negotiations.
Full details of the documents
(a) Communication from the Commission to the European Parliament and the Council on Exchanging and Protecting Personal Data in a Globalised World: (38493), 5191/17, COM (17) 7; (b) EU proposal for provisions on cross-border data flows and protection of personal data and privacy: (40020),—.
Previous Committee Reports
(a) Thirty-eighth Report HC 301–xxxvii, chapter 1 (12 September 2018); Twenty-ninth Report HC 301–xxviii (2017–19), chapter 1 (23 May 2018); Thirty-fourth Report HC 71–xxxii (2016–17), chapter 5 (8 March 2017); (b) Thirty-eighth Report HC 301–xxxvii, chapter 1 (12 September 2018).
56 So either at 29 March 2019 if there is a non-negotiated exit, or 31 December 2020 if the draft Withdrawal Agreement is adopted and ratified and there is a transition/implementation period.
61 The Commission has adopted three sets of model clauses which are available on the Commission’s website: https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en.
62 Legally binding data protection rules approved by the competent data protection authority which apply within a corporate group.
63 Together with binding and enforceable commitments of the controller or processor in the third country.
64 Case 311/18.
Published: 12 February 2019