Newington’s Lizzy Roberts summarises the latest EU position paper on the exchange and protection of personal data.

The Department for Exiting the European Union (DExEU) published the future partnership paper: The exchange and protection of personal data on 24 August.

The UK emphasises that there is unprecedented alignment in data protection between then UK and EU and suggests these high standards should remain in place at the point of the UK’s exit from the EU. It adds that the UK wants to explore building on the existing UK-EU model for exchanging and protecting personal data and align the two approaches to ensure the free flow of personal data.

Key provisions

Key provisions of the UK’s future partnership paper include:

• The UK will implement the EU’s new data protection framework in domestic law so that at departure from the EU, the UK’s domestic data protection rules will be aligned with the EU’s data protection framework
• The UK will seek to explore a UK-EU data exchange and protection model that builds on the existing adequacy model

• The UK would like its Information Commissioner’s Office (ICO) to continue to work with partner EU regulators to maintain regulatory cooperation
• The UK will remain fully aligned with the Europe’s Data Protection Convention (Convention 108) which is currently being updated
• The UK Government will continue to have responsibility for the content and direction of data protection policy and legislation within the United Kingdom

Looking to beyond the UK’s departure from the EU, the UK outlines that in building on the existing UK-EU adequacy model, a new UK-EU data exchange and protection model must:

• Maintain the free flow of personal data between the UK and EU
• Offer stability and confidence for businesses, public authorities and individuals
• Provide ongoing regulatory cooperation between the EU and UK on current and future data protection issues
• Continue to protect the privacy of individuals
• Respect UK sovereignty, including the ability to protect the security of citizens and the ability to maintain and develop its position as a leader in data protection
• Not impose unnecessary and additional costs to businesses
• Be based on objective consideration of evidence

The UK also emphasises that early on in the negotiating process, it will seek to agree the mutual recognition of the UK and EU’s data protection frameworks alongside an agreed negotiating timeline for longer-term arrangements.

It will also seek to ensure that data flows between the UK and third countries with existing EU adequacy decisions can continue.

Analysis

This paper underlines how important the UK’s data sector is to the economy, and emphasises how imperative it is to maintain the free exchange of personal data post-withdrawal from the EU.

The deal proposed would see the UK “continue to have responsibility for the content and direction of data protection policy and legislation within the United Kingdom” but emphasises how closely aligned the UK will seek to make its own framework with the EU’s. However, a new model may not be immune to potential complications. Under current rules, the European Commission decides unilaterally whether a nation complies sufficiently with EU regulation to permit the free flow of information. It remains to be seen whether this caveat would persist under a new deal.

Next steps

A third round of EU/UK negotiations is scheduled to take place next week ahead of the crucial European Council Summit in October where a decision will be taken by EU Heads of State to determine whether enough progress has been made to move on to the next stage of talks.

If you would like to speak to Newington about how your business could best outline its position to the Government please get in touch with our dedicated Brexit team at TeamNExEU@newingtoncomms.co.uk or call Lizzy Roberts on 020 7234 3332.