UK data protection proposals jeopardise adequacy agreement warns EU committee

The Chairman of the European Parliament’s Civil Liberties, Justice and Home Affairs (LIBE) Committee has written to the European Commissioner, Didier Reynders, to warn that the UK’s Data Protection and Digital Information (DPDI) Bill is close to being passed despite its potential to undermine the UK adequacy decisions under the EU’s General Data Protection Regulation (EU GDPR) and Law Enforcement Directive (LED). The DPDI Bill returns to the House of Lords on March 20.

Juan Fernandez López Aguilar writes that:

“The legislative process is now heading towards its end, and LIBE Members noticed that the law in question passed the UK House of Commons in November 2023 with many controversial provisions unchanged (such as lack of independence of supervisory authority or the removal of the Biometrics and Surveillance Camera Commissioner, which oversees the sharing of DNA and fingerprint data under Prüm cooperation with the EU).”

The UK Government have denied that the DPDI Bill would constitute a risk for the UK adequacy decision. Before sending the Bill to the House of Lords, MP John Whittingdale stated that the Government listened “to concerns about the perceived impact of the approval powers on the independence of regulators”. However, the issue of the independece of the ICO is still front and central, as demonstrated by López Aguilar’s letter. Another MEP tabled a written question only weeks ago, asking if the Commission intends to revoke the UK adequacy decision.

The UK adequacy decision allows UK companies and public bodies to share data with the EU freely. Losing such status would add significant red tape for UK businesses, disrupt trade, and would risk undermining important cooperation initiatives between the EU and the UK such as data sharing for research (Horizon), law enforcement (Prum) or immigration control purposes (Frontex). The cost to UK businesses has been estimated at £1-1.6 billion in legal fees alone.

The letter is the latest warning sign from the EU. Members of the European Parliament have already raised widespread concerns against the DPDI Bill and its potential to turn the UK into a data laundering heaven through a written question, a report on the implementation of the EU-UK Trade and Cooperation Agreement, and in a previous letter sent by López Aguilar on behalf of the LIBE committee. The Commission has confirmed in at least two responses that the risk of a revocation of the UK adequacy decision as a result of the DPDI Bill is real. Indeed, 28 civil society organisations and privacy experts wrote to the European Commission, asking to revoke the adequacy decision if the DPDI Bill were to become law.

Mariano delli Santi, Legal and Policy Officer for Open Rights Group said:

“The UK government has once again failed to listen to criticism and address the widespread concerns about this Bill.

The Lords now have an opportunity to address what the Government have negligently ignored: the Bill needs radical changes and a closer scrutiny than the one the House of Commons was afforded.

By acting recklessly, the Government are endangering our economy and our rights: If we were to lose this agreement, the cost to the UK tech industry and economy would be huge. The Bill not only harms the data protection rights of UK citizens but also the rights of European citizens in the UK and Europe.”

In June 2022, 30 UK civil society organisations denounced the rigged consultation process that led to the DPDI Bill and the UK Government’s refusal to listen to criticisms. This followed overwhelmingly bad feedback to the Government consultation “data a new direction”. Criticisms were reiterated in another open letter when the DPDI Bill was first tabled before the House of Commons. In November 2023, the Government presented 240 pages of amendments days before sending the Bill to the House of Lords, thus preventing the Commons from exercising meaningful scrutiny over the content of the Bill.