Cross-border co-operation on policing, security and criminal justice after Brexit Contents

5Data Adequacy and the ECHR

Data adequacy

104.Before the end of the transition period, Naomi Long MLA, Minister for Justice, Northern Ireland Executive described obtaining data adequacy status from the EU as “the single most important thing” for policing, security and criminal justice co-operation on the island of Ireland.256 On 19 February 2021, the European Commission announced that it was launching the process towards the adoption of data adequacy status for the UK.257

105.The Institute for Government has defined data adequacy:

Data adequacy is a status granted by the European Commission to countries outside the European Economic Area (EEA) who provide a level of personal data protection comparable to that provided in European law. When a country has been awarded the status, information can pass freely between it and the EEA without further safeguards being required.258

106.The decision whether to grant data adequacy is a regulatory decision by the European Commission. It was not part of the negotiations on the future relationship, but many forms of co-operation on information sharing between UK and Irish crime agencies depend on the UK having data adequacy status. For most data transfers involving the exchange of data between UK law enforcement agencies and their counterparts in the EU, the European Commission has to make a data adequacy decision in accordance with Article 36 of the Law Enforcement Directive.259 For the transfer of PNR, counter-terrorism and anti-money laundering data, the European Commission has to make a data adequacy decision in accordance with Article 45 of the General Data Protection Regulation.260 The Government applied to obtain data adequacy arrangements under both the Law Enforcement Directive and the General Data Protection Regulation.261

107.The European Commission announced on 19 February 2021 that it had concluded that the UK ensures “an essentially equivalent level of protection” to those guaranteed under the General Data Protection Regulation and the Law Enforcement Directive.262 Before the draft decisions are adopted, the European Data Protection Board must reach an opinion on the decisions, and a committee composed of representatives of the EU Member States must give the draft data adequacy decisions the green light.263 The decisions will need to be concluded by the end of June at the latest. This is because the TCA included provisions to allow for the transfer of data to continue as they had before the end of the transition period until the end of April 2021. These ‘bridging mechanisms’ can be extended by a further two months to the end of June 2021, at the latest.264 On 13 April 2021, the European Data Protection Board (EFDB) adopted opinions on the draft UK adequacy decisions.265 EFDB Chair, Andrea Jelinek said that the Board had concluded that:

The UK has mirrored, for the most part, the GDPR and LED in its data protection framework and when analysing its law and practice, the EDPB identified many aspects to be essentially equivalent. However, whilst laws can evolve, this alignment should be maintained. So we welcome the Commission’s decision to limit the granted adequacy in time and the intention to closely monitor developments in the UK.266

108.The PSNI stated that the UK being granted data adequacy will be key to continuing effective co-operation with An Garda Síochána:

Whilst the PSNI benefits from very positive and effective co-operation with our colleagues in An Garda Síochána, both formally and informally, this is predicated with a lawful and legal basis for the interaction. As such the provision of suitable data adequacy arrangements are critical to provide the basis for continued co-operation.267

In further evidence to our Committee, PSNI Assistant Chief Constable, Mark McEwan stressed that “data adequacy is the foundation of all our co-operation and collaboration arrangements”.268

109.The European Commission’s draft decisions to grant the UK data adequacy under the Law Enforcement Directive and GDPR sets out that these decisions will be valid for four years, after which a decision will be taken as to whether to renew the adequacy findings.269 European Commission Vice-President for Values and Transparency, Věra Jourová outlined that the Commission had included “clear and strict mechanisms in terms of both monitoring and review, suspension or withdrawal of such decisions, to address any problematic development of the UK system after the adequacy would be granted.”270 During the course of the inquiry, we also heard how other data adequacy decisions had been stuck down by the Court of Justice of the European Union (CJEU) following court challenges. Colin Murray and Dr Clare Rice told us it was notable that in “Schrems, the CJEU focused upon the lack of scrutiny of the United States’ data protection standards in striking down EU/US data sharing arrangements”.271

110.Minister Walker told the Committee that Government “stands ready to engage with any future review processes”.272 Mr Walker stated that this was an area where the UK and EU “started form the basis of complete alignment” and that the Government was “committed to maintaining high data protection standards now and in the future”.273 The Minister acknowledged that the Government would need to undertake ongoing work to demonstrate the UK’s data adequacy, commenting that if the UK lost its data adequacy status it would create “extra paperwork for operational partners, which is in nobody’s interests”.274

111.It is welcome that the UK has successfully obtained draft data adequacy decisions from the European Commission. The UK maintaining data adequacy status is key for the continuation of efficient data sharing between the PSNI and the Gardaí, as well as other UK and Irish crime agencies, and the finalising of data adequacy decisions is therefore critical. If granted, the UK’s data adequacy status will be reviewed periodically, and it may be subject to legal challenge as previous EU data adequacy decisions on third countries statuses have been. The Government must explain how it plans to ensure that the UK’s data protection regime continues to clear the necessary bar to maintain the country’s data adequacy status. The Government must proactively engage with the European Commission on this as part of efforts to ensure that data adequacy decisions are reached in good time, ahead of deadlines for their adoption, and to avoid uncertainty about the future of data sharing arrangements.

European Convention on Human Rights (ECHR)

112.The TCA sets out that law enforcement and criminal justice co-operation is to be underpinned by both the UK and EU’s commitments to human rights, including the European Convention on Human Rights.275 The TCA states that co-operation provided for in Part Three of the TCA covering Law Enforcement and Judicial Co-operation on Criminal Matters is based on the UK and EU’s

longstanding respect for democracy, the rule of law and the protection of fundamental rights and freedoms of individuals, including as set out in the Universal Declaration of Human Rights and in the European Convention on Human Rights, and on the importance of giving effect to the rights and freedoms in that Convention domestically.276

The Institute for Government notes that Part Three “can be terminated almost immediately if the UK or a member state denounce the European Convention on Human Rights or suspended if either side doesn’t sufficiently protect fundamental rights or the rule of law, as well as if a data adequacy decision is reversed”.277

113.Throughout the course of our inquiry, witnesses have raised the importance of the UK’s adherence to the European Convention on Human Rights (ECHR) in facilitating cross-border data sharing and effective extradition arrangements between the UK and Ireland. The UK will continue to be a Member State of the Council of Europe, and therefore bound by the ECHR. Some witnesses told us that their assessment is that the Human Rights Act is intrinsically linked to the UK’s adherence to the ECHR. Professor Mitsilegas told the Committee:

It [EU/UK Trade and Co-operation Agreement] does not mention the Human Rights Act as such, but it is clear that any decision from the UK to repeal the Human Rights Act will affect the functioning of the agreement...I personally find it untenable, in the scenario that the UK withdraws from the European convention on human rights, that you can expect the level of close co-operation in these fields that has been achieved with this agreement.278

Colin Murray concurred, adding that with regard to the new suspect surrender arrangement “there is very specific mention of the European convention and its operation within UK domestic law”.279 He argued that the EU “would not allow this system to continue to function if the UK was not fully implementing the European convention on human rights within domestic law, or at least as fully as it is now”.280 Before the reaching of the TCA, the Northern Ireland Human Rights Commission told us that any new extradition arrangements agreed between the UK and EU should “be based on robust human rights and legal safeguards for accused persons and for victims of crimes”.281

114.In November 2020, Minister Walker reiterated the Government’s commitment to the ECHR in evidence to our Committee:

We are absolutely committed to the ECHR, and this has been repeated constantly by Ministers from the Dispatch Box. It is an important part of the framework and I recognise that it forms an important part of the framework of the Good Friday Agreement. It is something in that respect that we absolutely maintain our commitment to.282

On 7 December 2020, the Government announced an Independent Review of the Human Rights Act led by Sir Peter Gross, former Court of Appeal Judge. The Terms of Reference of the Review state that “the HRA [Human Rights Act]is underpinned by the UK’s international obligations under the Convention[ECHR], and the UK remains committed to upholding those obligations”.283 Following the agreement of the TCA, Robin Walker said that the deal “ensures that the UK can give effect to its longstanding human rights obligations autonomously, and that reflects the fact of our EU exit”.284 He said that the TCA “does not make an explicit legally binding commitment to the ECHR” as the Government was concerned that the EU was “seeking a mechanism that could lead to unhelpful monitoring of our domestic human rights regime” in initial proposals it put forward.285 However, he acknowledged that

the agreement provides that either party can terminate co-operation with the other for any reason, if it so wishes, and that would include if either party were to denounce the ECHR. It is very clear that we are committed to human rights; we are committed to the implementation of those.286

115.The Committee supports fully the European Convention on Human Rights. We welcome the Government’s assurance, stated at the dispatch box and to this Committee in November 2020 and in March 2021, that it remains “absolutely committed” to the European Convention on Human Rights. The Trade and Co-operation Agreement is based on the UK continuing to apply the ECHR. The Government’s ongoing application of the ECHR is important in facilitating continued data sharing and effective extradition arrangements between the UK and Ireland. Robust human rights and legal safeguards both for accused persons and for victims of crimes are critical to providing a base from which effective and efficient co-operation can be facilitated. There is no room for doubt about the UK’s commitment to the ECHR or to its domestic effect. We welcome the fact that the Government will continue to uphold the European Convention on Human Rights in full, as successive Governments have done since 1950, when the UK was one of its founding signatories.

256 Q133 (Naomi Long MLA, Minister for Justice, Northern Ireland Executive)

258 Institute for Government, UK–EU future relationship: data adequacy, 2 July 2020

259 Directive (EU) 2016/680; see also: House of Commons Library Briefing, The UK-EU future relationship: the March 2020 EU draft treaty and negotiations update, 27 May 2020, p. 47

260 House of Commons Library Briefing, The UK-EU future relationship: the March 2020 EU draft treaty and negotiations update, 27 May 2020, p. 46–47

264 European Scrutiny Committee, Fortieth Report of Session 2019–21, HC 229-xxxv, 23 March 2021, p.13

265 European Data Protection Board, EDPB Opinions on draft UK adequacy decisions, 16 April 2021

266 European Data Protection Board, Press Release, European Data Protection Board - 48th Plenary Session, 14 April 2021

267 Police Service of Northern Ireland (CBC0004)

268 Q285 (Mark McEwan, Assistant Chief Constable, Police Service of Northern Ireland)

271 Colin Murray & Dr Clare Rice (CBC0010); see also: C-362/14 Schrems v Data Protection Commissioner

272 Q374 (Robin Walker MP, Minister of State, Northern Ireland Office)

273 Q374 (Robin Walker MP, Minister of State, Northern Ireland Office)

274 Q375 (Robin Walker MP, Minister of State, Northern Ireland Office); Q374 (Robin Walker MP, Minister of State, Northern Ireland Office).

277 Institute for Government, UK-EU Future Relationship: the deal; Law and Justice; 29 December 2020

278 Q252 (Professor Valsamis Mitsilegas, School of Law, Queen Mary University of London)

279 Q252 (Colin Murray, Reader in Public Law, Newcastle Law School, Newcastle University)

280 Q252 (Colin Murray, Reader in Public Law, Newcastle Law School, Newcastle University)

281 Northern Ireland Human Rights Commission (CBC0002)

282 Q202 (Robin Walker MP, Minister of State, Northern Ireland Office)

283 Ministry of Justice, Independent Human Rights Act Review: Terms of Reference, 7 December 2020, p.1

284 Q378 (Robin Walker MP, Minister of State, Northern Ireland Office)

285 Q378 (Robin Walker MP, Minister of State, Northern Ireland Office)

286 Q379 (Robin Walker MP, Minister of State, Northern Ireland Office)




Published: 28 April 2021 Site information    Accessibility statement