Open Rights Group open letter to UK Gov on data flows in No Deal Brexit
16 September 2019
To: The Prime Minister, Minister in Charge of Exiting the European Union, Duchy of Lancaster (Minister in charge of No Deal planning), Secretary of State for DCMS
Re: UK-EU data flows in the event of a no deal Brexit
We are writing further to the publication of the “Operation Yellowhammer” documents to express our concerns about the Government’s lack of preparedness for continuation of cross-border data flows in the event of a no deal exit from the European Union on 31 October 2019 or any other date.
The free flow of data between the UK and the EU is deeply important. Half of all UK trade in services is enabled by cross-border data flows. 75% of the UK’s international data flows are to and from the EU and much of the UK’s economic activity is dependent on these flows. 46% of UK exports are to the EU and services account for 49% of these exports.[1]
In a no deal exit, the legal right to freely transfer personal data from the EU to the UK will disappear overnight. Unless and until the European Commission issues a formal adequacy decision certifying that the UK’s legal framework meets the requisite standard for data protection, government – along with SMEs, charities, universities, public bodies and others – will have to put Standard Contractual Clauses (SCC) in place in order to continue to receive and access personal data held in the EU.
SCCs are burdensome, disruptive and costly: estimates suggest that the process costs in the remit of £10,000.[2] The Government’s guidance to use SCCs leaves businesses and public bodies out in the cold by encouraging risk assessments and legal advice but offering no other support.[3] They are ultimately something the Government should be seeking to avoid, not promote, especially as their basic legal validity is presently under challenge before the Court of Justice of the European Union.[4]
The Government has committed unilaterally to allow personal data flows from the UK to the EU and to extend the obligations of the UK data protection regime to organisations in those countries that process UK citizens’ data or market their services to people in the UK. Despite these assurances, we remain concerned about practical disruptions to these data flows and the effective remedies available to UK citizens in cases of breaches taking place in the EU.
This is particularly concerning in the case of public bodies that process UK citizens’ data in EU member states. In a report published earlier this year, out of 63 public bodies surveyed between October and December 2018, 75% admitted relying on data stored or processed in the EU. Nearly half of those said that not having access to the data would have a “high or very high impact on public services.”[5]
The Government urgently needs to ensure and demonstrate that personal data controlled by the Government and processed or stored in the EU will be accessible in the event of a no deal exit and that UK citizens will be able to effectively exercise their rights. In times of national turmoil, transparency is essential to inform citizens and build trust. We call on the Government to immediately publish the active steps that have been taken or are being taken within its own departments to manage the potential disruption to data flows in a no deal exit.
Achieving an adequacy decision from the European Commission could take years. It is going to be a key test of the UK’s data privacy standards and achieving adequacy will be far from straightforward. The UK has committed to maintaining GDPR standards post-Brexit but this is not the whole picture for data protection compliance, and when it comes to the protection of fundamental rights there are difficult questions to be addressed. This makes it even more imperative for the Government to do everything it can now to ensure that smooth continuation in data flows is maintained as far as possible.
Data flows are an incredibly important part of the UK’s economy and security and the digital exchanges between the UK and the EU are mutually beneficial. It is imperative that the UK’s exit from the EU avoids – as far as possible – stalling the free flow of data between these two vital trading partners.
The Government has stated that it wants to ensure unhindered data flows but the Operation Yellowhammer documents fail to detail how exactly it plans to do this. We urge the Government to make addressing this issue a priority.
Signed,
Open Rights Group
[1]Statistics on EU-UK Trade, House of Commons Library
https://researchbriefings.parliament.uk/ResearchBriefing/Summary/CBP-7851
[2]Brexit: Where will you be when the data stops flowing out of the EU?, Irish Independent, 23 September 2018
https://www.independent.ie/business/irish/brexit-where-will-you-be-when-the-data-stops-flowing-out-of-the-eu-37344281.html
[3]Accessing data from the European Economic Area under no-deal Brexit, HM Government, 8 August 2019
https://www.gov.uk/government/publications/accessing-data-from-the-european-economic-area-under-no-deal-brexit/accessing-data-from-the-european-economic-area-eea-under-no-deal-brexit
[4]Case C-311/18, Facebook Ireland & Schrems
[5]Data hitch may hit vital public services, The Times, 4 February 2019
https://www.thetimes.co.uk/article/data-hitch-may-hit-vital-public-services-3btzpkmhv?