The European Union has provisionally confirmed that the United Kingdom is set to join the list of countries with which they transfer data in a free and unfettered manner.
The decision is in the 'draft' stage at present but is likely to be adopted soon result after it's put to the EU's 27 member states.
What is the EU granting the UK?
The EU has decided to push forward with a decision to grant the UK something called 'adequacy' status. A draft of this decision was released on February 19.
Adequacy status for the UK means that the bloc considers the privacy laws and rules enforced in the country's territories to be of sufficient standard to move information to and from freely, safe in the knowledge it won't be abused or misused because the same protections don't apply.
Previous recipients of adequacy status include New Zealand, Canada, Uruguay, Argentina, Israel, and Japan. Smaller, non-EU European nations like Andorra and the Faroe Islands have also been afforded unfettered access in terms of data, and talks are apparently ongoing with South Korea to forge a similar deal.
Brexit bridges
When the UK officially withdrew from the European Union in January 2020, many aspects of the relationship between the two parties continued to be governed by transition-period protocols as a post-Brexit trade deal was fleshed out.
They were essential, too – it took until Christmas Eve for the UK and EU to agree on a deal, just days before the end of the transition period on December 31, 2020. In a dramatic illustration of how down to the wire negotiations became, the House of Commons only ratified the agreement on December 30. The EU is yet to ratify the trade agreement.
Within this deal, a 'bridge period' of four to six months was agreed to continue to allow flows of data to pass between the two entities whilst the EU mulled over its adequacy decision.
A smooth transition?
The Commission arrived at their decision to push forward with the adoption of this decree after the Commission's assessment determined that the UK ensures virtually the same protections and privileges as the EU's GDPR regulation and Law Enforcement Directive does.
Another factor in the Commission's decision is the fact the UK has remained party to the European Convention of Human Rights as well as Convention 108 of the Council of Europe, which the EU dubs "the only binding multilateral instrument on data protection" and is one of the first pieces of legislation that seeks to prevent individuals from experiencing harms born out of data abuse.
One thing making this process smoother – and a likely signal that the adequacy status will be adopted – is that UK data and privacy policy has been sculpted around EU legislation for several decades now. The hope is that, once the decision has been firmed up, digital trade will continue in a frictionless fashion.
UK GDPR vs EU GDPR
However, it's important to remember there will still be two separate sets of legislation: UK GDPR and EU GDPR. Since the first day of 2021, companies or organizations that handle data in both regions are now subject to both.
In terms of immediate change, companies may now need to appoint two different representatives to handle proceedings in the UK and EU, and also decide which one they will take as their 'lead authority'.
The ICO details that UK GDPR will have all the existing EU adequacy decisions and other data transfer mechanisms like Standard Contractual Clauses. However, now the UK will recognize no new transfer mechanisms approved by the EU, the ICO says, and will have to introduce its own SCCs.
Another change they detail is that UK GDPR will apply to 'processing for national security purposes' whereas the EU GDPR never applied to this, and the UK had to use an 'applied GDPR' for such processing previously.
What have EU officials said?
Věra Jourová, EU Vice-President for Values and Transparency, said that despite Brexit, the bloc still considers the United Kingdom a close partner on data-related issues:
Ensuring free and safe flow of personal data is crucial for businesses and citizens on both sides of the Channel. The UK has left the EU, but not the European privacy family.
However, she also emphasised the importance of reviewing and monitoring the situation, highlighting the "strict mechanisms" that have been installed in order to tackle any "problematic developments" of the UK system that would lead to regulatory incongruence.
And the UK government?
Downing Street is equally keen to push ahead with proceedings but did not pass up the chance to throw a jibe in the EU's direction for its purportedly sluggish approach, claiming the UK made its representations to the EU in a "timely manner" and it was in fact the Commission's decision not to finalize draft decisions in time that has drawn this out beyond the transition period.
The UK's Secretary of State for Digital was equally anxious to get the ruling over the line but echoed the government line on the EU's apparent lack of urgency:
Although the EU's progress in this area has been slower than we would have wished, I am glad we have now reached this significant milestone following months of constructive talks in which we have set out our robust data protection framework.
Dowden also called on the EU to confirm their decision as quickly as possible, as to not disrupt the flow of data and trade between the two entities now under distinct yet similar data regimes.
Whats happens next?
The EU still has to vote on adopting the adequacy status, which will have to be agreed upon by the 27 remaining nation-states that make up the bloc.
Before that, however, the decision has to be put to the European Data Protection Board, which offers a 'non-binding opinion' on the subject matter. The bloc's Commissioner for Justice said:
A flow of secure data between the EU and the UK is crucial to maintain close trade ties and cooperate effectively in the fight against crime. Today we launch the process to achieve that. We have thoroughly checked the privacy system that applies in the UK after it has left the EU. Now European data protection authorities will thoroughly examine the draft texts. EU citizens' fundamental right to data protection must never be compromised when personal data travel across the Channel.
The UK has also agreed to maintain a data-sharing relationship with the countries that the EU has adequacy agreements with, so performing such processes with places like Japan and Uruguay is scheduled to continue.
If the vote goes against the adequacy decision – which at this stage looks extremely unlikely – this could cause major problems for UK businesses.