Fortieth Report of Session 2019–21 Contents

2Data adequacy12

These EU documents have not been deposited by the Government under the current interim scrutiny arrangements. These documents are, however, legally and politically important because:

  • once adopted, they will provide the EU legal basis for the transfer of personal data from the EU to the UK. This is vital for the conduct of trade and law enforcement cooperation under the UK/EU Trade and Cooperation Agreement (TCA);
  • there are still stages in the adoption process which could delay the date of their adoption. In particular, any amendments which the Commission may need to make in response to the opinion of the European Data Protection Board, expected in April. This could present the risk of a data flows “cliff-edge” for the UK, as the bridging provisions under the Trade and Cooperation Agreement would only allow personal data flows to continue to the UK from the EU until the end of June at the latest;
  • after adoption, they will be under constant review and monitoring by the EU Commission as to whether the UK continues to provide “essentially equivalent” data protection and open to legal challenge in the EU legal order. Unless extended, they will in any event expire after 4 years. Any cessation in their application could be disruptive of both trade and law enforcement under the TCA; and
  • effective Parliamentary scrutiny of the maintenance of adopted decisions and the corresponding UK data protection legal framework forms one of the grounds on which the Commission has made its provisional positive data adequacy assessment for the UK. The Government also relied on effective scrutiny as a control on the Executive in its own “Adequacy Framework” to the Commission in March 2020. It will therefore be vital to the continuing application of the adopted decisions that the Government facilitate in a meaningful way the scrutiny of the House, this Committee and other interested Departmental Select Committees.

Action

  • To write to the Government for their initial view and response to our specific questions.
  • To report to the House and draw these matters to the attention of International Trade Committee; the Home Affairs Committee; the Digital, Culture, Media and Sport Committee; the Business and Industrial Strategy Committee; the Science and Technology Committee; the Health and Social Care Committee; the Northern Ireland Affairs Committee and the Joint Committee on Human Rights.

Overview

2.1A data adequacy decision that a third country provides “essentially equivalent” personal data protection to the EU comprises the most comprehensive and seamless basis for the transfer of data from the EU to that country. Whether for the purpose of trade or cooperation on law enforcement, data adequacy decisions enable data to flow lawfully to third countries from the EU without the need for further safeguards.

2.2The flow of personal data from the EU to the UK is vital for the EU-UK future relationship, particularly in terms of trade and law enforcement cooperation under the UK/EU Trade and Cooperation Agreement (TCA).

2.3On Friday 19 February, the EU Commission published both:

Further background information

2.4The Government had hoped that data adequacy decisions would be in place before the end of the transition period, having already itself legislated to allow UK to EU data flows. As they were not in place, the Trade and Cooperation Agreement (TCA) included “bridging provisions” to enable data flows from the EU to the UK to continue as they did before the end of the transition period, until 30 April 2021. These can be extended to 30 June 2021 at the latest. Quick progress towards adoption before the expiry of the “bridging provisions” is clearly desirable.

2.5Obtaining data adequacy decisions in these areas has therefore been an important goal for the Government. They published their formal application to the EU for adequacy decisions on 13 March 2020.

2.6Our initial assessment of the Government position has been drawn from:

2.7We address the political and legal importance of these documents and the need for their effective Parliamentary scrutiny later in this chapter (see both “Our Assessment” and our letter to the Government).

Our Assessment

Scrutiny of these documents

2.8Following the end of the post-Brexit transition period, the Government agreed to deposit documents relating to the Northern Ireland Protocol16 but no other EU documents are currently being deposited. These are the interim arrangements under which EU document scrutiny is presently taking place until the Government and the House reach a new arrangement.

2.9The EU documents considered in this chapter have not been formally deposited by the Government and therefore we have not received an Explanatory Memorandum outlining their potential implications for UK law and policy.

2.10This Committee’s remit is still to report to the House on EU documents of political and legal importance. This has not changed since 1 January 2021.

2.11The political importance of these documents is clear given their centrality to both trade and law enforcement cooperation between the EU and the UK.

2.12While the documents once adopted will not be directly legally-binding on the UK,17 nevertheless they have indirect legal or quasi-legal implications for the UK:

2.13Most telling of all, effective Parliamentary oversight of data protection issues by the Home Affairs Committee is referred to in the draft GDPR data adequacy decision19 as a contributing factor to the Commission’s overall adequacy assessment. The Government itself relies20 on this oversight in its submission documents to the EU.

2.14It is also relevant that the Chancellor of the Duchy of Lancaster (Rt Hon. Michael Gove MP) recently recognised the breadth and importance of this Committee’s responsibilities as now the sole Committee in the House of Commons with a specific EU scrutiny remit. In giving evidence21 to us on 8 February, he made reference to the Committee on the Future Relationship of the EU which ceased to exist on 16 January. He added:

That means inevitably that this Committee takes on even more responsibilities. Ultimately I don’t think its the Government that should decide the shape or the agenda of Select Committees; that is a House matter, but of course we will do everything we can to facilitate the effective scrutiny that the House needs to enjoy of Government activity.

2.15In summary, these are important and lengthy documents, with detailed recitals (87 and 49 pages respectively). Effective Parliament scrutiny of the Government’s activity and policy in relation to the decisions and the data protection framework forms a ground for the Commission’ positive adequacy assessment which the Government would be wise then to facilitate in a meaningful way. They are therefore deserving of our further scrutiny, informed by an official view from the Government and a prompt and full response to our specific questions set out in our letter.

Potential challenges for the Government

Before the adoption of the decisions

2.16As the adoption of the decisions is a unilateral EU process, the Government can only urge the EU to complete the process swiftly.

2.17While the publication of the draft decisions is proof that the Commission itself considers that the UK currently provides “essentially equivalent” data protection to the EU, it only marks the start of the decision-making process for their adoption. Further stages still to be navigated. In particular the adoption process could be delayed if the European Data Protection Board (EDPB) takes issue with the draft decisions and the Commission needs to amend them. While the EDPB discussed the draft decisions at its recent meeting of 9 March,22 at the time of writing there is no official confirmation of when the opinion may be delivered. Media expectation is that the opinion will be published in mid-April.23 However, there is no fixed timetable for the overall adoption process involving a committee of expert representatives from the Member States.

After adoption

2.18Even after adoption, there are other potential challenges for the Government to navigate:

2.19The Government will need to bear all these “post-adoption” factors listed in mind, when deciding to diverge from EU data protection law in future. Some future divergence seems likely, as indicated by the Secretary of State’s article in the FT (see paragraph 0.6 above) and further media reports.29 We also note that the consultation on the Government’s National Data Strategy ended on 9 December 2020. There is nothing in those reports to indicate that any changes are imminent or would pre-empt any adoption process. However, the Government’s position might be clearer if the Minister were to address Parliament or to write to this Committee directly on this issue (see the letter to the Government at the end of this chapter).

2.20Maintaining the adequacy decisions, once adopted, also relies on the Government recalling the broader range of factors that the EU Commission must consider when monitoring and reviewing the decisions. This means that changes not only to the UK data protection legal framework, but also wider legal and constitutional changes could have an impact. Specifically, those relating to the “rule of law” or “respect for human rights”. Likewise, how legal obligations under relevant international agreements between the EU and UK (including the Withdrawal Agreement and the Trade and Cooperation Agreement) but also between UK and other countries are interpreted and applied by the UK.

Action

2.21We have written to the Government in the terms set out below, asking for its view of the documents and focussing on these areas:

2.22The draft decisions are of cross-cutting relevance to the work of many Committees across the House. We are therefore also drawing the documents and this Report chapter to the attention of International Trade Committee; the Home Affairs Committee; Digital, Culture, Media and Sport Committee; the Business and Industrial Strategy Committee; the Science and Technology Committee; the Health and Social Care Committee; the Northern Ireland Affairs Committee and the Joint Committee on Human Rights.

Letter from the Chair to the Minister for Media and Data (Rt Hon. John Whittingdale OBE MP), Department for Digital, Culture, Media and Sport and the Parliamentary Under-Secretary of State (Kevin Foster MP), Home Office

The Committee has asked me to write to you concerning the draft data adequacy decisions that the EU Commission published on 19 February 2021. As one relates to the flow of personal data to the UK from the EU for commercial purposes and the other for law enforcement purposes, we thought that our scrutiny of the documents would involve both of your respective Ministerial remits.

You may be aware that following the end of the post-Brexit transition period, the Government agreed to deposit documents relating to the Northern Ireland Protocol but no other EU documents are currently being deposited. These are the interim arrangements under which EU document scrutiny is presently taking place until the Government and the House reach a new arrangement.

The draft EU data adequacy decisions have not been formally deposited by the Government and therefore we have not received an Explanatory Memorandum outlining their potential implications for UK law and policy. We consider these documents to be of significant legal and political importance and have a number of questions regarding their potential implications for the UK.

When preparing your response to the Committee, you may wish to bear in mind that effective Parliamentary scrutiny of the Government’s data protection activities forms one of the grounds on which the Commission has made its initial positive data adequacy assessment. Effective Parliamentary oversight of data protection issues by the Home Affairs Committee is referred to in the draft GDPR data adequacy decision.30 The Government itself relies31 on this oversight in its submission documents to the EU. It is therefore important for the adoption and maintenance of these decisions that Government does all it can to facilitate in a meaningful way both ours and other Select Committee scrutiny.

As you know, these draft decisions are not yet ‘done and dusted’. There are still some potential hurdles in the adoption process, including the opinion of the European Data Protection Board. We understand from media reports that the opinion in expected in mid-April. We would be grateful if you could update our officials as to whether that timetable is accurate and indeed as to any other indications of the likely timetable for adoption of the decisions. In any event, we would expect you to inform the Committee of any likely sticking points that emerge in the opinion and what the Government can do in response to provide any reassurance to the Commission. We are mindful of the risks of any delays to the adoption process, given that the current bridging arrangements for continued EU to UK data flows only last until the end of June at the latest.

Assuming that the decisions are adopted in time, we have a number of questions as to how the Government will ensure in future that the decisions remain in place and are extended beyond their four-year shelf life. We are aware of the potential for both the Commission to amend, suspend or revoke the decisions should it consider that the UK no longer provides “essentially equivalent” data protection to the EU. We are also aware of the potential for legal challenge of the decisions before the Court of Justice (CJEU) given the fate of both US data adequacy decisions. We also note the potential problems that could be caused for both the good functioning of the trade and law enforcement parts of the Trade and Cooperation Agreement (TCA) should the decisions run into difficulty. In view of these risks, we would like to know:

2.23We look forward to receiving a response to this letter within 10 working days.

12 (a) Proposal for a Commission Implementing Decision;—; Article 45(3) of Regulation 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ; DCMS;—; 41796; (b) Proposal for a Commission Implementing Decision;—; Article 36(3) of Directive 2016/680 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and on the free movement of such data and repealing Council Framework Decision 2008/977 JHA; HO;—; 41797.

13 Article 45 (3) of the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

14 Article 36(3) of the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

15 “New approach to data is a great opportunity for the UK post-Brexit”, 27 February 2021, Secretary of State for Digital, Culture, Media and Sport (Rt Hon. Oliver Dowden CBE MP).

16 Letter from Rt Hon Michael Gove (Chancellor of the Duchy of Lancaster) to Lord Kinnoull Lords EU Committee, 14 January 2021

17 They are only binding in the EU internal legal order and are addressed to the Commission and Member States.

18 If due to “serious and systemic” failures in data protection on the part of the UK.

19 See recital 3.2.3.4.

20 See “Select Committees” heading, page 44 of Section F Law Enforcement, UK Government’s “Adequacy Framework”.

21 Q6, Oral evidence: The UK’s new relationship with the EU, HC 1197, 8 February 2021.

22 The EDPB Press Release of 10 March states “The Board discussed the draft UK adequacy decisions, which were received from the European Commission. The EDPB will thoroughly review the draft decisions, taking into account the importance of guaranteeing the continuity and high level of protection for data transfers from the EU”.

23 See MLex headline “UK data adequacy decisions due to receive EDPB opinion in mid-April” (26 February 2021). Viewing the full article requires a subscription.

24 C-362/14.

25 C-311/18.

26 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)

27 C623–17.

28 See Art.LAW.OTHER.137 TCA.

29 For example, Sky News, ‘Government to reform data protection laws to spur economic growth‘ (11 March 2021)

30 See recital 3.2.3.4.

31 See “Select Committees” heading, page 44 of Section F Law Enforcement, UK Government’s “Adequacy Framework”.




Published: 23 March 2021 Site information    Accessibility statement