Japan Trade Deal punches USA-sized hole in privacy

The UK has just signed its first new free trade agreement, independently from the EU, with Japan. We believe that clauses in the UK Japan trade agreement pose an existential threat to data protection rights in the UK, as we outline in a briefing.

The UK Japan trade agreement, published in mid October, was supposed to be uncontroversial, negotiated in record time with minor changes to the existing treaty the UK inherited from the EU. However, it contains brand new clauses which place the “free flow of data” between the UK and Japan, and from there on to other trade partners, over and above data protection rights.

Assuming that the UK simply recognises data protection as “adequate” in January, over time, current restrictions on European data to stop lightly regulated transfers to the USA, could disappear.

A “free flow of data” approach would be a radical departure from the current position. Today, UK companies must only transfer your personal data where they can guarantee that you continue to have similar rights over access, correction and deletion of that data. The UK Japan agreement could force the UK to accept lower data protection frameworks, including voluntary self-regulation, as compatible with the UK’s world leading privacy framework, in Article 8.80 and 8.84.

If data is exported from the UK to the USA via Japan under lower or voluntary arrangements, your rights would vastly reduce. In the USA, there is no automatic right for you to know where the data is held, or by whom; you cannot prevent resale, reuse, or the data being put to new uses. There is no right to prevent your data from being used in ways that are discriminatory, or unfair. You cannot ask for your data to be deleted. If it is lost, then there is no legal barrier to a third party from obtaining it and using it. And there is no simple recourse to you if your data is breached or sold. Data transfers from the EU to the USA require significant extra safeguards to be legal.

Japan, however relies on lightly policed, voluntary arrangements, which may be extremely hard for a data subject to enforce their rights through without resorting to US courts.

The UK Government can continue to attempt to impose restrictions against the flow of data to the USA, mirroring the current arrangements. However, the UK Government may not be able to maintain such restrictions if challenged, as these could violate the terms of the Trade Agreement it has just negotiated.

It would prove impossible for the EU to easily conclude a data protection adequacy decision for the UK if the UK moved away from using an ‘adequacy’ system itself. The EU specifically excluded onward data flows from their trade agreement with Japan. Although Japan has an adequacy decision from the EU, it had to put specific arrangements in place for EU data to stay in Japan.

This stopped the data of people in the EU — including the UK — from being shifted to an overlapping legal regime and freely siphoned off to third countries. This trade deal places these safeguards in legal danger.

If data flows were enabled, the EU could ask the UK to mirror the arrangement with Japan, and “segregate” EU data and ensure it does not flow onwards to the US. However, this would create a large bureaucratic overhead for UK businesses trading with the EU.

It is unacceptable for the UK to threaten the high levels of data protection we currently enjoy by allowing legal claims to push data free-for-all through obscure clauses in a trade agreement. Parliament must demand answers, and ensure the Government “freezes” these clauses from the treaty.

Freezing controversial clauses has precedents — the same occurred with the IP chapters of the Trans Pacific Partnership (TPP). It is easy enough to do and would not affect other sections of the treaty. The ongoing economic relationship between the UK and Japan does not need these rushed provisions with seismic ramifications. It is in Parliament’s hands to make that happen.

This blog has been edited to make it clear that changes to the data protection regime are dependent on the use of the articles in trade agreements to deliver the free flow of data.