Documents considered by the Committee on 23 May 2018 Contents

1Exchanging data with non-EU countries

Committee’s assessment

Legally and politically important

Committee’s decision

Not cleared from scrutiny; recommended for debate on the floor of the House together with the proposed Council Decisions on the signing and conclusion of the EU-Japan Economic Partnership Agreement; further information requested; drawn to the attention of the Digital, Culture, Media and Sport Committee, the International Trade Committee, the Business, Energy and Industrial Strategy Committee, the Science and Technology Committee and the Exiting the EU Committee

Document details

Communication from the Commission to the European Parliament and the Council on Exchanging and Protecting Personal Data in a Globalised World

Legal base

Department

Digital, Culture, Media and Sport

Document Number

(38493), 5191/17, COM(17) 7

Summary and Committee’s conclusions

1.1This Commission Communication is significant in highlighting the approach of the EU to the exchange of data with third countries for trade and other purposes in a way which adequately protects EU citizens. As such, it is highly relevant to the UK at the end of the proposed transition/implementation period, scheduled to be 31 December 2020. The background to the Communication and a detailed summary of its content are set out in our previous Report of 8 March 2017.1

1.2The Government said in their Future Partnership Paper on the “Exchange and Protection of Personal Data”2 that the UK:

“…wants to explore a UK-EU model for exchanging and protecting personal data, which could build on the existing adequacy model, by providing sufficient stability for businesses, public authorities and individuals, and enabling the UK’s Information Commissioner’s Office (ICO) and partner EU regulators to maintain effective regulatory cooperation and dialogue for the benefit of those living and working in the UK and the EU after the UK’s withdrawal.”

1.3The predominant view amongst commentators and others3 has been that a Commission adequacy decision would be the best option for the UK to share data with the EU after the end of the implementation period. In brief, to obtain an adequacy decision the UK would have to demonstrate equivalent legal protections for EU citizens and their personal data to those of EU data protection and e-privacy rules. The Government says in its Future Partnership Paper that the UK’s new Data Protection Bill “… will implement the EU’s new data protection framework in our domestic law. At the point of our exit from the EU, the UK’s domestic data protection rules will be aligned with the EU data protection framework”.4

1.4It is worth noting for the purposes of the conclusions to this Report chapter that the Government also adds in the Future Partnership Paper that it is:

“…essential that as part of the UK’s future partnership with the EU, we agree arrangements that allow for free flows of data to continue, based on mutual trust in each other’s high data protection standards” [our emphasis].

1.5Despite the prevalent emphasis on the option of an adequacy decision, there have been three recent developments which raise the question of whether an international agreement could be the preferred vehicle for an EU-UK data-sharing arrangement instead:

i)In an oral evidence session on 9 May with the Exiting the EU Committee,5 experts including the Information Commissioner agreed the preferred mechanism for future EU-UK data sharing would be a bespoke data-sharing treaty, rather than an adequacy decision, which could also provide for a role for the Information Commissioner’s office.

ii)In the presentation produced by the UK negotiating team “Framework for the UK-EU Security Partnership” and published on 9 May,6 the UK refers to its intention to seek a “separate UK-EU agreement on the exchange and protection of personal data” consisting of a “bespoke UK-EU model for exchanging and protecting personal data which builds on the existing adequacy model”.7

iii)In February the Commission proposed some “non-negotiable” horizontal clauses for trade deals to govern the inclusion of personal data flows.8

1.6This Report chapter focuses on the last of these three developments. When we last wrote to the Government on 29 March 2017,9 we highlighted the Commission’s previous position on data flows in trade agreements, as set out in this Communication. The Commission considered that trade negotiations and dialogue concerning a Commission adequacy decision would need to take place separately on parallel tracks. This was because the Commission considered that the EU personal data protection rules could not be the subject of a negotiation, nor was it procedurally compatible to include an adequacy decision which is a unilateral implementing act (a form of EU tertiary legislation) following its own distinct legal process within a trade deal. We asked the Government to keep us updated on this issue, especially in the context of the EU-Japan trade deal.

1.7The horizontal clauses relating to data flows in trade agreements (paragraph 5(iii) above) are appended to a letter from the Commission to the Chair of the Data Working Group (DAPIX) at the European Council dated 9 February 2018. They are referred to as “ horizontal provisions for cross-border data flows and for personal data protection in EU trade and investment agreements”. A summary of the letter and the provisions appears at paragraphs 1.13–1.14 below.

1.8We note that since these clauses were produced, it has been reported that they were due to be considered at an informal meeting of national trade representatives on May 8.10 However, subsequent reports have indicated that the Bulgarian Presidency does not intend to present the clauses for formal consideration by the Council and certainly not at the Council meeting of 22 May.11 On 14 May, a Commission spokesman has been reported as saying that no decision has been taken to use the clause in any specific trade or investment negotiations and that if the Commission were to consider tabling the clauses in the context of a specific trade negotiation it would consult the Council and inform the European Parliament in line with EU Treaty requirements for negotiating trade deals.12 Nevertheless, draft Council conclusions on clauses have also made their way unofficially into the public domain .13 The leaked draft document includes draft conclusions that the Council considers that:

1.9This Communication raises important issues for the UK’s future data-sharing relationship with the EU which have been heightened by recent developments. These include the question of whether an international agreement, bespoke or part of a wider trade deal, could be the vehicle for future EU-UK data-sharing arrangements. The proposed horizontal clauses on data flows produced by the Commission are particularly significant because the Commission has insisted in this Communication that dialogues on an adequacy decision for sharing personal data and trade negotiations should be kept separate. It is for this reason that provision for personal data flows was not made in the EU-Japan Economic Partnership Agreement.14 We therefore recommend this document for debate on the floor of the House together with the proposed Council Decisions on the signing and conclusion of the EU- Japan Economic Partnership Agreement.

1.10The proposed horizontal clauses for cross-borders flows have not been deposited by the Government as they are not clearly subject to mandatory deposit under our Standing Orders. However, we request the Government to deposit them with us voluntarily together with an EM, as envisaged by our Standing Order 143 (1)(vi)15 and preferably before the debate is scheduled. We note that the Government has recently deposited with us the proposed Regulation on horizontal clauses on safeguards16 together with its Explanatory Memorandum. We understand that the form of document containing the horizontal data clauses is different and that there is uncertainty about whether it will be considered by the Council at all. Nevertheless, we are confident that the Government will appreciate how important it is for us to have as much scrutiny oversight as possible over such an important potential component of future trade deals, including between the EU and the UK.

1.11Before the debate is held, we would like the Government to answer the following questions:

a)Regardless of press reports, have these horizontal clauses on data flows in trade agreements been discussed informally or formally in Coreper or the Council yet? If so, what is the view of the UK and other Member States? If not, what is the Commission’s intention in producing the clauses?

b)What does Article B achieve, legally-speaking, in terms of personal data flows? Does it provide for data exchange based on mutual trust and mutual recognition by the EU and the third country in question of each other’s data protection standards? If so, would the clause satisfy the UK’s aspirations for a future data-sharing arrangement based on mutual trust as set out in its Future Partnership Paper?17

1.12We draw this chapter and document to the attention of the Digital, Culture, Media and Sport Committee, the International Trade Committee, the Business, Energy and Industrial Strategy Committee, the Science and Technology Committee and the Exiting the EU Committee.

Full details of the document

Communication from the Commission to the European Parliament and the Council on Exchanging and Protecting Personal Data in a Globalised World: (38493), 5191/17, COM (17) 7.

Summary of the Commission’s letter and horizontal clauses for data flows and personal data protection

1.13In this summary, any reference to a trade agreement should also be taken as including investment agreements. In the covering letter to the draft provisions, the Commission says:

1.14It then appends the wording of Articles A, B and X,18 together with the following explanation:

Previous Committee Reports

Thirty-fourth Report HC 71–xxxii (2016–17), chapter 5 (8 March 2017).


1 Thirty-fourth Report HC 71–xxxii (2016–17), chapter 5 (8 March 2017).

2 Published by DEXEU on 24 August 2017.

3 See for example “Brexit: the EU data protection package”, 3rd Report of Session 2017–19, 18 July 2017, HL Paper 7, Summary of conclusions and recommendations, paragraph 2.

4 The implementation date for the Law Enforcement Data Directive was 6 May. The General Data Protection Regulation (GDPR) is applicable to the UK from the 26 May. The Bill completed its Third Reading on 9 May and “Ping Pong” in the Lords is scheduled for 14 May.

5 Oral Evidence Session, 9 May 2018, “The progress of the UK negotiations on UK withdrawal, HC 372, Q1563–1566.

6 “Framework for the UK-EU Security Partnership” May 2018, HM Government.

7 See page 25 of the Presentation.

8 Cover note from the Commission to “Delegations” of 1 March enclosing a letter from the Commission to the Chair of the DAPIX Working Group in the European Council and appending “Horizontal Provisions for cross-border data flows and for personal data protection”. When these clauses were produced, they were classified as “Limité” but that classification has now been lifted.

9 Letter from the former Minister for Digital and Culture at the Department for Digital, Culture, Media and Sport (Matt Hancock) to Sir William Cash as Chairman of the European Scrutiny Committee, 16 March 2017 and letter from Sie William Cash as Chair of the European Scrutiny Committee to the former Minister for Digital and Culture at the Department for Digital, Culture, Media and Sport (Matt Hancock), 29 March 2017.

10 See Informal Trade Committee Experts Meeting (Services and Investments), ECOFIN of 8 May, listed on Bulgarian Presidency website.

11 See meeting of the Foreign Affairs Council (Trade), 22 May 2018.

12 “Data Flows—Draft Conclusions raise pressure on Commission”, Politico Pro [Pay Wall] 15 May 2018.

13 “EU Presidency floats draft conclusions on data flows, Politico Pro [Pay Wall], 14 May 2018.

14 39640,7959/18 and 39639, 7960/18: Proposed Council Decisions on the signing and conclusion on behalf of the EU of the Economic Partnership Agreement between the EU and Japan.

15 See Standing Order 143 (1(vi): The expression “European Union” document means “any other document relating to European Union matters deposited in the House by a Minister of the Crown”.

16 (39641), 8141/18: Proposed Regulation implementing the safeguard clauses and other mechanisms allowing for the temporary withdrawal of preferences in certain agreements concluded between the European Union and certain third countries.

17 “The exchange and protection of personal data—A Future Partnership Paper”, August 2017.

18 Accessible also from the link provided at footnote 3.




Published: 29 May 2015