Insight
The three deaths of EU-UK data adequacy
by Zach Meyers and Camino Mortera-Martinez,15 November 2021 European and British businesses can still freely transfer personal data between the EU and UK. This situation has spared both sides disruption – but is unlikely to last. In December 2020, as the deadline for Britain’s departure from the EU’s single market approached, British and European businesses became increasingly nervous. Boris Johnson’s choice to prioritise regulatory freedom over close economic ties with the EU spelled trouble for businesses on both sides of the Channel. In part, this was because the EU could have made it significantly harder for companies to store and process the personal data of EU citizens on UK servers. Most businesses gather personal data for one reason or another – whether it is because they make money out of transferring data or they simply operate a single customer database for their clients in Britain and elsewhere. In the absence of an adequacy decision, these businesses would have only had a few options, all of them costly. The most straightforward option is to rely on ‘standard contractual clauses’ (SCCs) – provisions added into business contracts to allow for data transfers. But even SCCs are not easy to implement: they cannot be adopted mechanistically, and the business must assess on a case-by-case basis whether additional data protections are required. The UK government estimates that adopting SCCs would impose a financial impact of £1.4bn on UK businesses trading with the EU over five years, much of which would be borne by small businesses. Eventually, the UK and the EU managed to avoid this disruption. The British government retained the EU’s General Data Protection Regulation (GDPR) in domestic law, and said it would continue to allow free data transfers to the EU. And the European Commission decided that the UK would continue to provide an adequate level of protection of personal data, thereby allowing data flows to continue without any new safeguards. That adequacy decision is separate from the UK-EU trade and co-operation agreement (TCA), which is on life support due to the parties’ dispute about the Northern Irish protocol. But, regardless of the fate of the TCA, seamless data transfers from Europe to Britain are very unlikely to last. There are three scenarios, any one of which could kill the EU’s adequacy decision: the European Court of Justice (ECJ) ruling that the
CER INSIGHT: The three deaths of EU-UK data adequacy 15 November 2021
info@cer.EU | WWW.CER.EU
1