Hurry up and make a deal on post-Brexit data flows, would you? Think of UK business – MPs

The UK government has been told to urgently start negotiations for a data adequacy deal with the European Union – or risk damaging business and placing a prohibitive burden on small firms.

The warning comes in a report from the House of Commons' Exiting the European Union Committee, which looks specifically at the UK's preparations for data flows and sharing after Brexit.

Although politicians have been happy to emphasise the importance of ensuring continued smooth transfers of data across the Channel, many observers feel the government has been slow to appreciate the challenges of securing a deal.

The UK's slim proposal, outlined last year, called for an early agreement with the EU in the form of a two-way international treaty, rather than a one-way decision from the European Commission as would be more usual for an adequacy decision.

But the committee said the government needs to provide more information on what it believes is the procedure for securing an international treaty on data, and how this would differ from an adequacy deal.

It is also suggested the UK works to ensure there won't be a data cliff edge after exit in the short-term, and then think about negotiating a bespoke agreement that could then replace the third-party arrangements conferred by a "simple adequacy decision".

As such, the government is told to push the EU to start negotiations with urgency – ideally before the transition phase begins next year – because leaving the bloc without a deal would cause businesses on both sides major problems.

"The UK government should be preparing for the adequacy process and ensuring that there is no risk of a gap in legal provision for transferring data between the UK and the EU after December 2020," it said.

The committee also pointed out that there was a "high chance of a legal challenge to any proposed UK-EU data international agreement", which could again "create regulatory gaps and uncertainty for business".

The report warned of a risk to business if a data adequacy deal is not reached at all: other methods for data transfers, such as Standard Contractural Clauses or binding corporate rules, are "unsatisfactory substitutes", the committee said.

"Such alternatives would represent a considerable change from the status quo, would place a bureaucratic burden on individual businesses, a burden which would be prohibitive for many small businesses."

However, EU chief negotiator Michel Barnier has indicated that the UK's suggestions might not be possible, saying that a data adequacy decision "can only be taken once we are able to assess the new UK legal framework".

He also gave short shrift to the idea that the UK can remain on the European Data Protection Board, saying the EU "cannot, and will not" share its decision-making powers with a third country.

The UK's proposal that it stays in other co-operative mechanisms – such as the One-Stop Shop, which allows organisations that operate in a number of member states to deal with just one supervisory authority – has also been met with little enthusiasm.

The MPs noted Barnier's comments and suggested that the UK will need to compromise if it wants such added extras, saying it should accept that the Court of Justice of the European Union will continue to have jurisdiction over aspects of data protection law in the UK after Brexit "to increase the prospects of securing the Prime Minister's objectives".

Elsewhere in the report, the committee said the UK's proposal on data-sharing – which would allow the UK to stay in information exchanges on passenger records, fingerprints and DNA data – is unprecedented.

"There are no existing models for third country data exchange covering the degree of data sharing in criminal justice that the UK is seeking."

But, it pointed out, the UK needs an adequacy decision to engage in such data sharing for law enforcement and, again, would have to accept the jurisdiction of the CJEU. ®