• Accessibility
• Email alerts
• RSS feeds
• Contact us

Chapter 4: Data and digital trade

Data adequacy

158.Personal data transfers from the EU to third countries, such as the UK, are governed by the 2016 General Data Protection Regulation (GDPR).220 Under GDPR, the EU Commission may unilaterally grant an ‘adequacy’ decision confirming that a third country provides a comparable level of data protection to that in EU law. This allows cross-border transfers of personal data from the EU to the third country without additional safeguards.

159.Personal data transfers in the other direction—from the UK to the EU—are not affected by this process. The UK Government has previously implemented provisions permitting the transfer of personal data from the UK to the EEA (as well as to third countries which have previously been granted EU adequacy).221

160.Discussions between the European Commission and the Government on the EU’s assessment of UK data adequacy took place last year, but did not lead to a full EU data adequacy decision before the end of the transition period. Instead, the TCA contains a temporary ‘bridging mechanism’ allowing for the continued free flow of personal data from the EU to the UK, conditional on the UK maintaining its existing levels of data protection. This bridging mechanism lasts either until an adequacy decision has been made, or for four months (extending to six months unless one Party objects).222

161.The Minister, Lord Grimstone, told us:

“[The] reason we did not conclude negotiations on data adequacy in no way related to any questions of principle or substance. It was purely that we ran out of time to do it … [the EU] frankly, left insufficient time to ratify decisions.”223

162.On 19 February, the European Commission approved a draft data adequacy decision which, if confirmed, will allow EU data to continue to flow to the UK. This decision will be scrutinised by the European Data Protection Board before it is implemented, but the Board cannot block the adequacy decision. It will also need to be approved by EU Member States. If adopted, the adequacy decision lasts for an initial period of four years, after which it may be renewed.224

163.Evidence was submitted to this inquiry while there was still uncertainty over whether an adequacy decision would be granted. However, the evidence on the costs of a ‘no adequacy’ scenario remains relevant. As well as highlighting the importance of the adequacy decision, it highlights the residual risks to UK businesses if the decision were to be struck down by the Court of Justice of the EU—a credible scenario, given the Court’s recent case-law—or were not to be renewed after four years.

Importance of data adequacy

164.George Riddell told us: “Adequacy is extremely important for businesses, particularly those that are data heavy and collect or process data that is covered by the GDPR.”225 Nick Collier stressed that “financial services do not work without personal data, particularly in banking and insurance”.226 The UK Interactive Entertainment association (UKIE), which represents the video games industry, told us that data adequacy is “paramount” for the sector,227 while Horace Trubridge, General Secretary of the Musicians’ Union, said, “There is a saying in the music industry: ‘Data is king’. It is vital.”228

165.The absence of data adequacy would not necessarily prevent EU-UK personal data transfers,229 but without it firms would have to rely on alternative legal safeguards, notably Standard Contractual Clauses (SCCs) and Binding Corporate Rules. These would make data transfers much more “cumbersome and unwieldy”230 than under adequacy arrangements. Professor Sarah Hall and Martin Heneghan of the University of Nottingham characterised SCCs as “a costly legal process that requires written agreements from both the sending and receiving parties”.231 UK Finance said that the alternatives to data adequacy were “feasible in some cases and not in others, but always more complex (and expensive) for both the customer and the business”.232

166.Such costs would have hit SMEs the hardest. As Professor Sarah Hall and Martin Heneghan said: “Larger multinational firms are likely to be better able to access the legal advice needed to establish SCCs, as compared to smaller firms.”233 The Law Society of England and Wales, the Advertising Association, UKIE and the Royal Institute of British Architects (RIBA) also highlighted the disproportionate impact on smaller firms.234

167.Before the draft adequacy decision was published, the Government had stressed that businesses should prepare for a scenario where adequacy is not granted “as a sensible precaution”, and that they “should consider putting in place alternative transfer mechanisms”.235

168.Witnesses offered different perspectives on the state of business preparedness. On the one hand, George Riddell told us that “companies had been spending quite a lot of money” to prepare for a ‘no adequacy’ scenario.236 On the other, the Federation of Small Businesses (FSB) told us that as recently as December 2020, only 3% of surveyed members had renegotiated contracts to insert SCCs.237

169.Even with an adequacy decision, firms will still need to make changes. For example, George Riddell highlighted the need for companies to appoint a new data representative in an EU Member State.238

Long-term picture

170.The Commission’s draft data adequacy decision is welcome, but even if confirmed it is not guaranteed to be permanent. Witnesses highlighted in particular the impact of the 2020 ‘Schrems II’ decision of the Court of Justice of the European Union (CJEU), which struck down the EU-US data arrangements known as Privacy Shield.239 Highlighting that the UK decision was the first EU data adequacy decision since the Schrems II ruling, Neil Ross said: “The EU is generally very worried that any adequacy decision it finds in favour of the UK or another third country is struck down in the European Court of Justice … If we do not have good dialogue and mistrust develops, it is very likely that the adequacy decision could be revoked at some point in the future.”240

171.Data policy is a fast-moving area, both in the EU and globally. Even with a positive adequacy decision, the increasing divergence between the EU and the US on data flows, which was highlighted by the Schrems II ruling, could give rise to policy and commercial dilemmas for the UK. As George Riddell told us, “The trilateral dataflow between the EU, UK and the US is an incredibly important consideration for many companies that operate across those three jurisdictions.”241

172.EU data adequacy is of vital importance for a wide range of service providers, and we warmly welcome the Commission’s recent draft decision, which, if confirmed, will allow EU-UK transfers of personal data to continue.

173.We note, however, that a positive adequacy decision is not guaranteed to be permanent, given the requirement for renewal after four years and the precedent set by recent legal challenges, including the Schrems II case in 2020. The Government should therefore maintain close dialogue with the EU on data to support the long-term stability of EU-UK data flows, and ensure that the implications for EU data adequacy are factored into any changes to the UK’s domestic data protection regime.

Digital Trade

Digital trade chapter of the TCA

174.The TCA contains an unprecedented and comprehensive chapter on Digital Trade. The Government described the Digital Trade chapter as containing “some of the most modern and liberalising provisions of any trade agreement in the world”.242 They include:

(a)A prohibition on data localisation (requirements for firms to store or process data in a certain location);243

(b)Guarantees that the Parties will not discriminate against electronic signatures or electronic documents on the basis that they are in digital form;244 and

(c)Provisions on open government data.245

175.Witnesses praised the Digital Trade chapter. Neil Ross told us: “The agreement excels in the digital and tech space. It goes well beyond what the EU has agreed with other trading partners, and it is a very good sign of the UK putting a good foot forward in digital trade.”246 He specifically highlighted the provisions on open government data: “The EU has not agreed that with any [other] trading partner.”247

176.Witnesses also praised the prohibition of data localisation, which is a major potential trade barrier. Neil Ross described the provisions as “very strong”,248 while the FSB told us they would “allow SMEs to take advantage of the opportunities of digital trade”.249

177.TheCityUK also welcomed the ban on data localisation, noting that such measures “make it harder for businesses to comply with regulatory requirements related to fighting financial crime, the fight against cyber-attacks, and are also a major barrier to trade”. But it added that “it is not yet clear how the ban on localisation in the TCA will relate to financial services data because the digital trade chapter also contains a carve-out for prudential regulation”250 (see paragraph 15).

178.A number of witnesses highlighted drawbacks of the TCA compared with Single Market membership. The Advertising Association and the FSB highlighted the loss of the Country of Origin principle under the e-Commerce directive.251 This stipulates that companies trading online are bound by the rules in the Member State in which they are based, rather than the state where their products or services are delivered to the customer. Losing this principle will add complexity for UK companies selling their services online.

Looking forward

179.The Digital Trade chapter is by its nature forward-looking. The provisions on cross-border data flows are subject to a three-year review clause, and there are provisions facilitating cooperation on emerging technologies.252 Neil Ross encouraged the Government to consider it as a “living document”:

“If we want to make sure that it is still a leading digital trade chapter in three, five, 10 years’ time, we will need good engagement and a good relationship between the UK and the EU as we go forward.”253

Similarly, Professor Sarah Hall and Martin Heneghan said that the chapter’s review clauses would facilitate updates as technology evolves.254

180.As mentioned in paragraph 171, the UK’s ambitions on digital trade could be undermined if it is caught between divergent US and EU approaches to data privacy and regulation. While a detailed discussion of these issues is beyond the scope of this report, they remain an ongoing concern that will require the Government to carefully monitor developments and communicate them to affected businesses.

181.We welcome the TCA’s digital trade chapter, which is one of the strongest areas of the deal for services and provides extensive liberalisation which goes beyond comparable EU FTAs.

182.Digital trade is a fast-moving area, and the provisions will need to be updated as new technologies develop. The Government should make use of the TCA’s framework for further dialogue, as well as the review clause, to ensure the digital trade provisions remain up to date.

• A-Z index
• Glossary
• Contact us
• Freedom of Information
• Jobs
• Using this website
• Copyright