Impact of Brexit on the free movement of data - The EDPS gives an Opinion

The UK has now left the EU and is in a transition period until 31 December 2020, during which the sides will negotiate their future partnership.  The envisaged partnership will comprise of three main components: 

i) general arrangements (including provisions on basic values and principles and on governance); 

ii) economic arrangements (including provisions on trade and level playing field guarantees); and 

iii) security arrangements (including provisions on law enforcement and judicial cooperation in criminal matters, as well as on foreign policy, security and defence.

In its 24 February Opinion, on the opening of negotiations for a new partnership with the UK, the European Data Protection Supervisor (EDPS) notes that the EU and UK will continue to have many interests in common. As such, an extensive exchange of information, including personal data, between the EU and the UK can be expected.  The EDPS supports the Commission in its endeavours to aim at a comprehensive partnership and to achieve as much as possible during the transition period. 

With regard to the free flow of data for both commerce and matters of law enforcement, the EDPS welcomes the proposal to include data protection among the initial provisions, as a basis for cooperation and for there to be negotiations for granting an adequacy decision in respect of the UK, if the applicable conditions are met. These conditions are set out under EU law, mainly in the GDPR (No 2016/679) and Law Enforcement Directive ((EU) No 2016/680).

As a balancing point, the EDPS highlights that uniquely - as a former member of the EU - the UK has in principle integrated all the EU acquis into its national law.  However, any substantial deviation from these by the UK which result in a lowering of protection, would constitute an important obstacle to a finding of adequacy, and may give grounds for the revocation of any granted adequacy should they become apparent in the future.   

Finally, the EDPS, mirroring the scout's motto 'be prepared', urges that the EU take steps to prepare for all eventualities, including where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

Only time will tell if the negotiations are successful and, with one eye on the clock, the EDPS reminds the Commission that if it issues a draft adequacy decision, all necessary documentation should be provided to the European Data Protection Board in a timely manner as required under Article 70(1)(s) GDPR, so as to allow an informed Opinion to be issued.  Tick Tock!