Data adequacy and EU-UK deal ratification: post-Brexit decision time

Nathaniel Hayward, international policy assistant at the Law Society, poses two burning questions: what is the future of the EU-UK Trade and Cooperation Agreement? Will the EU adopt a positive adequacy position towards the UK’s data protection regulation?

The UK and EU are currently wrestling with two critical post-Brexit issues in the search for an equitable settlement for their future relationship.

The biggest and most pressing concern is the EU ratification of the Trade and Cooperation Agreement (TCA) agreed by the two parties last year at the eleventh hour.

The second and entirely separate issue is the question of continued frictionless data flows between the EU and the UK.

A grace period was included in the final text of the TCA allowing for the continuation of data-sharing but this is due to expire in 2021.

The UK now awaits the EU’s approval of the data adequacy decision, which will allow data to continue to flow between the EU and UK.

A hostage to fortune

When the negotiating parties from the EU and UK announced that a ‘Trade and Cooperation Agreement’ had been signed between the bloc and its former member state, businesses and politicians around Europe let out a collective sigh of relief.

Necessarily, given the relief with which it was greeted, the ultimate ratification of the TCA by the EU Parliament was considered merely as a matter of form.

Yet such confidence, while not entirely misplaced, has certainly been shaken in recent months.

As with other EU trade agreements, the Council and the Conference of Presidents (noting that it should not become a precedent) allowed for a provisional application of the clauses of the TCA from 1 January to 28 February 2021 by which time it was hoped (certainly by the UK) that the internal processes of the EU would have come to their ultimate conclusion and ratification by the EU Parliament would have been a fait accompli.

However, the provisional application has already been extended until 30 April to allow more time for scrutiny, much to the UK’s chagrin.

In this new timeline, ratification would have been completed during the course of the Parliament’s plenary session on 26 to 29 April.

Due to the uncertainty caused for businesses and individuals, the UK has only begrudgingly accepted the necessity of this temporary measure to satisfy the EU’s need to allow for scrutiny by the multiple political organs of the bloc in such a short timeframe.

Cracks in the façade of pragmatism

The first crack in the façade of pragmatism (if not actual good will) came on the 29 January when the EU threatened to unilaterally trigger article 16 of the Northern Ireland Protocol and introduce export controls on vaccines being produced in the bloc.

After protests from the British government, the Irish taoiseach and politicians of every shade in Northern Ireland, the EU relented and the EU Commission president Ursula von der Leyen announced that the EU and UK had reaffirmed their commitment to maintaining the free flow of goods and services into Northern Ireland, including vaccines.

The second misstep came from the UK.

With the transition-friendly ‘light touch’ regulation schemes on trade inflows from Great Britain to Northern Ireland due to expire at the end of March 2021, the UK unilaterally announced the extension of this relaxed programme of border checks to October of this year to avoid a cliff-edge implementation of the additional regulation created by the Northern Ireland Protocol.

Such a move violates the Northern Ireland Protocol and the Withdrawal Agreement more generally and the reaction from both the EU Commission and the Parliament has been predictably furious and has resulted in a carrot-and-stick approach to coaxing compliance from its former member state.

The Commission, intent on wielding a heavy stick, is exploring legal options for redress, such as triggering the WA’s dispute settlement mechanism.

The atmosphere in the EU Parliament is no-less incendiary but its reaction has been more measured, utilising the ‘carrot’ of ratification to encourage the UK to reconsider its position.

The parliamentary veto right over the TCA puts it in a unique position to pressure the UK into rethinking its violation of the WA and it seems intent on making powerful use of this leverage.

To this end, the EU Parliament has now decided not to set a date for implementation of the TCA and in several specific resolutions has set compliance with the WA as a precondition for ultimate ratification of the TCA.

The danger is not that the Parliament will refuse to ratify the TCA, an outcome which remains highly unlikely at this point (and would be fatal to the agreement in any case).

Rather, the danger lies in the fact that should the EU Parliament fail to ratify the agreement by the end of the plenary session on the 29 April, then they will be forced to seek agreement from the UK to extend the temporary arrangement, an extension which the UK would be loath to grant.

So, as if in some ancient story, the lingering presence of the ‘no-deal’ bogeyman rises from its legislative tomb to haunt the corridors of Brussels and Westminster once again.

Free flow or free fall?

The second post-Brexit issue in need of prompt resolution is the question of whether the EU will grant a positive data adequacy decision to the UK.

On the basis of article 45 of Regulation (EU) 2016/679, the EU Commission has the power to determine whether a country outside the EU has an adequate level of data protection to allow for the flow of personal data from the EU without additional safeguards being necessary.

In such a case, transfers of data to the third country would be treated in much the same way as intra-EU data transmissions.

The UK has been keen to secure a favourable outcome to the Commission’s adequacy deliberations, the principle aim being to prevent increased costs and administrative burdens for UK businesses reliant on frictionless data transfers from the bloc to ensure the efficient running of their business.

The TCA did not specifically address the question of data adequacy since these are subject to a separate process altogether, but it did allow for a four month (extendable to six months) ‘grace period’ wherein the data transfers between the UK and EU would not be treated as data transfers to a third country.

This bridging period was specifically put in place in order to allow for the finalisation of the EU Commission’s draft adequacy decisions and their approval by the EU.

This grace period certainly came as a relief to UK businesses that hadn’t yet been able to put in place safeguards to ensure compliance with EU data rules but much like the provisional application of the TCA, something of a sticking plaster.

There is currently no fixed date for when the outcome of the EU’s data adequacy decision but the outlook is generally considered to be positive.

More recently news came that the matter has passed the first of three formal tests in the progress towards a positive data adequacy decision.

On 19 February, the Commission issued draft adequacy decisions for transfers of personal data to the UK in respect of the General Data Protection Regulation and the Law Enforcement Directive, indicating in detail that the Commission believes the UK has an equivalent, that is to say ‘adequate’, level of data protection to that provided for in EU law.

The next stage in the process will see the draft adequacy decisions being considered by the European Data Protection Board (EDPB).

Once the EDPB adopts its opinion, the draft measures are then put to each of the member states for approval before finally being adopted by the EU Commission.

Such a decision would mean that the UK joins a group of third countries such as Canada, Japan and New Zealand who have all been the subject of positive adequacy decisions from the EU and, subject to other GDPR obligation being met, would allow for the continued free flow of personal data from the EU to the UK.

The threat of legal challenge

This all sounds like positive news but, in reality, there remains a significant challenge to a final resolution of the matter in the UK’s favour.

The primary danger lies in the threat of a legal challenge to the approved data adequacy decision by the Court of Justice of the EU (CJEU) with the possible result that the decision could be declared invalid, as happened with the EU-US Privacy Shield which came into force in 2016 and was declared invalid in July 2020.

Some commentators believe that such an eventuality is relatively likely, especially given the fact that Privacy International (Case C-623/17), via the CJEU, has recently successfully challenged the UK’s mass electronic surveillance practices carried out by the Secret Intelligence Services.

The existence of a previous successful challenge to UK data privacy regulation may encourage further challenges should the EU finally deliver a positive decision on the UK’s data adequacy.

On a broader point of UK data policy, even if the data adequacy decisions are finally ratified by the various institutions of the EU, they will be subject to a formal review process every four years.

As time passes the danger that UK data protection laws will diverge from EU standards grows.

The UK is faced with a delicate balancing act between developing its own data protection regime whilst maintaining EU confidence in the continuing parity of UK data protection rules. Part of this decision matrix will be the adequacy decisions of the UK with respect to other third countries.

If the UK plays too fast and loose in its treatment of other data jurisdictions, then it risks losing the contingent confidence in its regime.

UK in limbo

In both of these burning questions, so pertinent to the future of EU-UK relations, the power to resolve the situation is dependent on both political will and pure institutional process.

In the first, the decision is dependent on the attitude of the EU Parliament and on the behaviour of the UK towards the Northern Ireland border issue.

In the second case, it’s reliant upon the methodical and pragmatical progress of procedure though the ultimate decision is of course open to the influence of a multitude of different institutional actors.

In both cases, however, time is running short and as the deadlines appear swiftly ahead, the danger for both the UK and the EU grows.