The Department for Digital, Culture, Media & Sport (‘DCMS’) published, on 13 March 2020, its explanatory framework for adequacy discussions (‘the Explanatory Framework’), outlining that the UK is seeking adequacy decisions from the European Commission (‘the Commission’) in order to maintain the continued free flow of personal data between the EU and UK and Gibraltar after the Brexit transition period.
Adequacy decision process
In order for an adequacy decision to be adopted, the Commission must find that the third country’s data protection standards are ‘essentially equivalent’ to those of the EU, taking into account the existence of basic content principles such as privacy principles and data subject rights, specific safeguards for special categories of data, direct marketing and automatic decision-making, procedural and enforcement mechanisms including an independent supervisory authorities, and essential guarantees on national security and law enforcement access. In this regard, the Explanatory Framework describes that after the transition period, the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’) will no longer apply in the UK, but highlights that the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (‘UK GDPR’) which amends the Data Protection Act 2018 and merges it with additional requirements of the GDPR, will lead to an equivalent protection of data subjects.
Stewart Room, Partner at DWF Law LLP, told OneTrust DataGuidance, “The ‘UK GDPR’ is a necessary step within the Brexit process, because EU law cannot continue to apply in the UK after the end of the transition period. I do not anticipate there to be a major departure from the data protection principles or the data subject rights and for those reasons the two laws will remain fundamentally aligned. I think it is worth stressing that the Brexit situation has not identified any substantial differences in principle between the UK and the EU on data protection law. It is more about sovereignty and the taking back of control, which would free the UK from the EU-ties, but the law is likely to head in the same direction in both jurisdictions.”
The future of the ICO
The Explanatory Framework states that the Information Commissioner’s Office (‘ICO’) has a strong track record as an independent regulator capable of handling complex cases and imposing tough sanctions where necessary, has a full range of enforcement powers, is well-resourced, and has worked closely with other data protection authorities while being part of the same legal data protection framework. Room continues, “There are many ways that cooperation will be achieved in the context of an adequacy through multi-lateral ties. However, I would expect the ICO to be granted an observer status within the European Data Protection Board. “
While the Explanatory Framework outlines in detail the similarities with regards to rights, obligations and structure laid down in both privacy frameworks, other aspects of the relationship between the UK and the EU after the transition period are not yet fully settled. In particular, the Explanatory Framework details that the UK remains a committed member to the Council of Europe, the European Court of Human Rights and the European Convention on Human Rights (‘ECHR’), however, the Commission’s Chief Negotiator Michel Barnier detailed, on 5 March 2020 after the first round of post-Brexit talks that the UK had informed him that it would not formally commit to applying the European Convention on Human Rights in a trade agreement, which in turn would lead to practical consequences for their cooperation.
Room highlighted, “If the UK was to depart from the ECHR, that would be a factor to be considered within the adequacy decision process, but it would not be determinative of the issue. Being a party to the ECHR is not a condition of adequacy. Regardless, I do not expect the UK to depart from the principles of Article 8 of the ECHR.”
Lea Busch Privacy Analyst
Comments provided by:
Stewart Room Partner
DWF Law LLP