104.Before the end of the transition period, Naomi Long MLA, Minister for Justice, Northern Ireland Executive described obtaining data adequacy status from the EU as “the single most important thing” for policing, security and criminal justice co-operation on the island of Ireland. On 19 February 2021, the European Commission announced that it was launching the process towards the adoption of data adequacy status for the UK.
105.The Institute for Government has defined data adequacy:
Data adequacy is a status granted by the European Commission to countries outside the European Economic Area (EEA) who provide a level of personal data protection comparable to that provided in European law. When a country has been awarded the status, information can pass freely between it and the EEA without further safeguards being required.
106.The decision whether to grant data adequacy is a regulatory decision by the European Commission. It was not part of the negotiations on the future relationship, but many forms of co-operation on information sharing between UK and Irish crime agencies depend on the UK having data adequacy status. For most data transfers involving the exchange of data between UK law enforcement agencies and their counterparts in the EU, the European Commission has to make a data adequacy decision in accordance with Article 36 of the Law Enforcement Directive. For the transfer of PNR, counter-terrorism and anti-money laundering data, the European Commission has to make a data adequacy decision in accordance with Article 45 of the General Data Protection Regulation. The Government applied to obtain data adequacy arrangements under both the Law Enforcement Directive and the General Data Protection Regulation.
107.The European Commission announced on 19 February 2021 that it had concluded that the UK ensures “an essentially equivalent level of protection” to those guaranteed under the General Data Protection Regulation and the Law Enforcement Directive. Before the draft decisions are adopted, the European Data Protection Board must reach an opinion on the decisions, and a committee composed of representatives of the EU Member States must give the draft data adequacy decisions the green light. The decisions will need to be concluded by the end of June at the latest. This is because the TCA included provisions to allow for the transfer of data to continue as they had before the end of the transition period until the end of April 2021. These ‘bridging mechanisms’ can be extended by a further two months to the end of June 2021, at the latest. On 13 April 2021, the European Data Protection Board (EFDB) adopted opinions on the draft UK adequacy decisions. EFDB Chair, Andrea Jelinek said that the Board had concluded that:
The UK has mirrored, for the most part, the GDPR and LED in its data protection framework and when analysing its law and practice, the EDPB identified many aspects to be essentially equivalent. However, whilst laws can evolve, this alignment should be maintained. So we welcome the Commission’s decision to limit the granted adequacy in time and the intention to closely monitor developments in the UK.
108.The PSNI stated that the UK being granted data adequacy will be key to continuing effective co-operation with An Garda Síochána:
Whilst the PSNI benefits from very positive and effective co-operation with our colleagues in An Garda Síochána, both formally and informally, this is predicated with a lawful and legal basis for the interaction. As such the provision of suitable data adequacy arrangements are critical to provide the basis for continued co-operation.
In further evidence to our Committee, PSNI Assistant Chief Constable, Mark McEwan stressed that “data adequacy is the foundation of all our co-operation and collaboration arrangements”.
109.The European Commission’s draft decisions to grant the UK data adequacy under the Law Enforcement Directive and GDPR sets out that these decisions will be valid for four years, after which a decision will be taken as to whether to renew the adequacy findings. European Commission Vice-President for Values and Transparency, Věra Jourová outlined that the Commission had included “clear and strict mechanisms in terms of both monitoring and review, suspension or withdrawal of such decisions, to address any problematic development of the UK system after the adequacy would be granted.” During the course of the inquiry, we also heard how other data adequacy decisions had been stuck down by the Court of Justice of the European Union (CJEU) following court challenges. Colin Murray and Dr Clare Rice told us it was notable that in “Schrems, the CJEU focused upon the lack of scrutiny of the United States’ data protection standards in striking down EU/US data sharing arrangements”.
110.Minister Walker told the Committee that Government “stands ready to engage with any future review processes”. Mr Walker stated that this was an area where the UK and EU “started form the basis of complete alignment” and that the Government was “committed to maintaining high data protection standards now and in the future”. The Minister acknowledged that the Government would need to undertake ongoing work to demonstrate the UK’s data adequacy, commenting that if the UK lost its data adequacy status it would create “extra paperwork for operational partners, which is in nobody’s interests”.
111.It is welcome that the UK has successfully obtained draft data adequacy decisions from the European Commission. The UK maintaining data adequacy status is key for the continuation of efficient data sharing between the PSNI and the Gardaí, as well as other UK and Irish crime agencies, and the finalising of data adequacy decisions is therefore critical. If granted, the UK’s data adequacy status will be reviewed periodically, and it may be subject to legal challenge as previous EU data adequacy decisions on third countries statuses have been. The Government must explain how it plans to ensure that the UK’s data protection regime continues to clear the necessary bar to maintain the country’s data adequacy status. The Government must proactively engage with the European Commission on this as part of efforts to ensure that data adequacy decisions are reached in good time, ahead of deadlines for their adoption, and to avoid uncertainty about the future of data sharing arrangements.
112.The TCA sets out that law enforcement and criminal justice co-operation is to be underpinned by both the UK and EU’s commitments to human rights, including the European Convention on Human Rights. The TCA states that co-operation provided for in Part Three of the TCA covering Law Enforcement and Judicial Co-operation on Criminal Matters is based on the UK and EU’s
longstanding respect for democracy, the rule of law and the protection of fundamental rights and freedoms of individuals, including as set out in the Universal Declaration of Human Rights and in the European Convention on Human Rights, and on the importance of giving effect to the rights and freedoms in that Convention domestically.
The Institute for Government notes that Part Three “can be terminated almost immediately if the UK or a member state denounce the European Convention on Human Rights or suspended if either side doesn’t sufficiently protect fundamental rights or the rule of law, as well as if a data adequacy decision is reversed”.
113.Throughout the course of our inquiry, witnesses have raised the importance of the UK’s adherence to the European Convention on Human Rights (ECHR) in facilitating cross-border data sharing and effective extradition arrangements between the UK and Ireland. The UK will continue to be a Member State of the Council of Europe, and therefore bound by the ECHR. Some witnesses told us that their assessment is that the Human Rights Act is intrinsically linked to the UK’s adherence to the ECHR. Professor Mitsilegas told the Committee:
It [EU/UK Trade and Co-operation Agreement] does not mention the Human Rights Act as such, but it is clear that any decision from the UK to repeal the Human Rights Act will affect the functioning of the agreement...I personally find it untenable, in the scenario that the UK withdraws from the European convention on human rights, that you can expect the level of close co-operation in these fields that has been achieved with this agreement.
Colin Murray concurred, adding that with regard to the new suspect surrender arrangement “there is very specific mention of the European convention and its operation within UK domestic law”. He argued that the EU “would not allow this system to continue to function if the UK was not fully implementing the European convention on human rights within domestic law, or at least as fully as it is now”. Before the reaching of the TCA, the Northern Ireland Human Rights Commission told us that any new extradition arrangements agreed between the UK and EU should “be based on robust human rights and legal safeguards for accused persons and for victims of crimes”.
114.In November 2020, Minister Walker reiterated the Government’s commitment to the ECHR in evidence to our Committee:
We are absolutely committed to the ECHR, and this has been repeated constantly by Ministers from the Dispatch Box. It is an important part of the framework and I recognise that it forms an important part of the framework of the Good Friday Agreement. It is something in that respect that we absolutely maintain our commitment to.
On 7 December 2020, the Government announced an Independent Review of the Human Rights Act led by Sir Peter Gross, former Court of Appeal Judge. The Terms of Reference of the Review state that “the HRA [Human Rights Act]is underpinned by the UK’s international obligations under the Convention[ECHR], and the UK remains committed to upholding those obligations”. Following the agreement of the TCA, Robin Walker said that the deal “ensures that the UK can give effect to its longstanding human rights obligations autonomously, and that reflects the fact of our EU exit”. He said that the TCA “does not make an explicit legally binding commitment to the ECHR” as the Government was concerned that the EU was “seeking a mechanism that could lead to unhelpful monitoring of our domestic human rights regime” in initial proposals it put forward. However, he acknowledged that
the agreement provides that either party can terminate co-operation with the other for any reason, if it so wishes, and that would include if either party were to denounce the ECHR. It is very clear that we are committed to human rights; we are committed to the implementation of those.
115.The Committee supports fully the European Convention on Human Rights. We welcome the Government’s assurance, stated at the dispatch box and to this Committee in November 2020 and in March 2021, that it remains “absolutely committed” to the European Convention on Human Rights. The Trade and Co-operation Agreement is based on the UK continuing to apply the ECHR. The Government’s ongoing application of the ECHR is important in facilitating continued data sharing and effective extradition arrangements between the UK and Ireland. Robust human rights and legal safeguards both for accused persons and for victims of crimes are critical to providing a base from which effective and efficient co-operation can be facilitated. There is no room for doubt about the UK’s commitment to the ECHR or to its domestic effect. We welcome the fact that the Government will continue to uphold the European Convention on Human Rights in full, as successive Governments have done since 1950, when the UK was one of its founding signatories.
256 (Naomi Long MLA, Minister for Justice, Northern Ireland Executive)
257 European Commission, , 19 February 2021
258 Institute for Government, , 2 July 2020
259 Directive (EU) 2016/680; see also: House of Commons Library Briefing, , 27 May 2020, p. 47
260 House of Commons Library Briefing, , 27 May 2020, p. 46–47
262 European Commission, , 19 February 2021
263 European Commission, , 19 February 2021
264 European Scrutiny Committee, Fortieth Report of Session 2019–21, , 23 March 2021, p.13
265 European Data Protection Board, , 16 April 2021
266 European Data Protection Board, Press Release, , 14 April 2021
267 Police Service of Northern Ireland ()
268 (Mark McEwan, Assistant Chief Constable, Police Service of Northern Ireland)
269 European Commission, , 19 February 2021
270 European Commission, , 19 February 2021
271 Colin Murray & Dr Clare Rice (); see also:
272 (Robin Walker MP, Minister of State, Northern Ireland Office)
273 (Robin Walker MP, Minister of State, Northern Ireland Office)
274 (Robin Walker MP, Minister of State, Northern Ireland Office); (Robin Walker MP, Minister of State, Northern Ireland Office).
275 Article LAW.GEN.3: Protection of human rights and fundamental freedoms, HM Government, , 24 December 2020
276 Article LAW.GEN.3: Protection of human rights and fundamental freedoms, HM Government, , 24 December 2020
277 Institute for Government, UK-EU Future Relationship: the deal; ; 29 December 2020
278 (Professor Valsamis Mitsilegas, School of Law, Queen Mary University of London)
279 (Colin Murray, Reader in Public Law, Newcastle Law School, Newcastle University)
280 (Colin Murray, Reader in Public Law, Newcastle Law School, Newcastle University)
281 Northern Ireland Human Rights Commission ()
282 (Robin Walker MP, Minister of State, Northern Ireland Office)
283 Ministry of Justice, , 7 December 2020, p.1
284 (Robin Walker MP, Minister of State, Northern Ireland Office)
285 (Robin Walker MP, Minister of State, Northern Ireland Office)
286 (Robin Walker MP, Minister of State, Northern Ireland Office)