Skip to main content
  • The CBI chevron_right
  • Deep dive: What is data adequacy and why is it so important in the UK-EU negotiations?

Deep dive: What is data adequacy and why is it so important in the UK-EU negotiations?

One of the lesser talked about aspects of trade in services in the UK-EU negotiations is the data adequacy decision.

13 Oct 2020, 6 min read

The UK is a hub for global data flows: 11.5% of global cross-border data flows pass through the UK, 75% of this traffic is with the EU. The impact of the end of the transition period on data flows could be disruptive if the UK does not receive a data adequacy decision from the EU by 31 December.

Why is this important?

Trade is increasingly facilitated by cross border data flows, and businesses rely on this ability to transfer data for offering their goods and services. From services-based industries like financial services, to the logistics companies transporting goods around the world, data underpins trade, innovation, and ‘business as usual’ for many firms. Any restrictions on data flows will impact UK and EU business competitiveness and harm people on both sides of the channel.

Being deemed ‘adequate’ on data will mean that the EU considers the UK to provide a level of personal protection comparable to that provided in European law, and that data can pass freely between it and the EEA without the need for further safeguards. Securing a data adequacy decision is therefore mutually beneficial, supporting consumers and businesses on both sides of the Channel. And this has been recognised by the negotiators, with UK and EU officials understanding the need to keep data flowing and warm assurances from both sides. But as the end of the transition period looms, many are increasingly concerned that adequacy will not be granted by the end of the year.

Where are the challenges?

Even though the UK and the EU are starting from a point of unprecedented alignment on data, an adequacy decision – which sits outside of the free trade agreement negotiations – is likely to get caught up in the politics of the negotiations. From the outset of these negotiations, leading figures highlighted the concern over the tight timeframes to secure an agreement. Historically, the shortest time it has taken for a country to achieve adequacy with the EU is 18 months – making the timeframe for UK adequacy particularly ambitious.

This was complicated further by the recent Schrems II judgement, which could alter the European Commission’s approach to granting adequacy decisions and place additional challenges on the negotiations. Although it was a US-EU ruling, it does have implications on the Brexit negotiations. You can find out more about the ruling and what that means for business here.

The Schrems II ruling will also have significant implications for the UK as it seeks to develop its own framework of agreements to enable data flows with both the EU and the US. This will be impacted by the outcome of the ongoing US-EU discussions as well as the details of the UK-EU adequacy assessment.

This week, another legal ruling also had the potential to disrupt the UK getting an adequacy decision. On Tuesday, the CJEU ruled on bulk retention of data, for the purposes of national security, following a challenge from Privacy International focused on the UK, France and Belgium. Though the court ruled that many data retention regimes are within the scope of privacy laws, it also detailed carve-outs for national security agencies. This judgement highlights how the spotlight is increasingly on national security and how it impacts a country’s data protection regime.

However, despite these challenges, the CBI’s recent conversations with those in the negotiating room suggest that although there are concerns around these recent rulings, officials are pleased with the direction on data adequacy and the shape of the text for the decision is moving in a positive direction.

What are the implications for business if the UK doesn’t secure an EU adequacy decision?

Failure to receive an adequacy decision by the end of the transition period will disrupt data flows, impacting businesses and people across the UK and EU. Though the UK plans to unilaterally recognise the EU as adequate, meaning UK data flows to the EEA will be largely unaffected, the EU will treat the UK as a third country. This means that UK businesses who receive data from Europe will need to implement new safeguards as the UK will no longer automatically be recognised as having the same standard of data protection as the EU.

Transfers of EEA data to the UK are still possible if no agreement is reached. But this will rely on additional legal safeguards being put in place. There are clearly defined processes for transferring data using the appropriate safeguards, such as standard contractual clauses (SCCs) or Binding Corporate Rules (BCRs). This process does take time and has cost implications, putting the responsibility on businesses in both the UK and the EU. Further information and resources on what your business needs to do to continue receiving EU data in a no deal scenario can be found here.

Key questions for business to consider

Continuity plans for the end of the transition period will be unique to every organisation. However, there are some key questions your plan should answer, to ensure the major issues are covered. You can find our list of key questions and resources to assist with your Brexit planning here.

Further resources:

Please get in touch with Shara Samra, UK/EU Negotiations Policy Adviser, for more information in regards to data and the EU negotiations.