In the second in our three part look at the slow moving world of regulatory plate tectonics, our EMEA Associate and roving expert on all things to do with privacy, cybersecurity and digital ethics delves into what is happening in the UK.
- Part 1: Narrowing the Atlantic Gap: the EU and US are drifting together. An Executive Order signed this week promises to narrow the transatlantic regulatory gap. But will this be enough?
- Part 2: Britain Adrift (again): meanwhile the UK’s post Brexit relationship with the EU is being tested as it proposed to rip up red tape, water down GDPR and cooperate more with the US. As English Channel widens and the UK drifts towards the US, will this leave the EU out of reach?
- Part 3: Crossing the Divide: where are we headed and how can the data sharing and data protection conundrum be resolved to (almost) everyone’s satisfaction?
There is an undeniable fact that should now be obvious to all, but that politicians in the UK are still unwilling to admit or discuss.
“Brexit is a total disaster that was sold to us on the basis of a set of complete lies”
There may be some die hard ‘brexiteers’ (or fools) that might question this, but six years after Brexit we have yet to see any of the benefits predicted by the ‘brexiteers’ while the disadvantages all to accurately predicted by the ‘remainers’ are becoming a very obvious reality. Six years after Brexit you’d have thought that there might be something positive to show for it, but alas there is nothing at all. The main areas of dispute were:
- Trade: we were promised numerous post-Brexit free trade agreements. A few have been put in place, mainly with countries that already had such agreements with us pre-Brexit. Effectively the only new one has been with Australia. While the new trade with Australia might provide a boost to the economy of 0.08%, the loss of the free trade with Europe has had a negative impact of about 4%. Hardly a good exchange.
- Taking back control of our borders: we have seen little change in the flow of refugees across the English Channel with the French hardly in the mood to cooperate, while the shortage of cheap labour from Europe has impacted everything from farming to hotels and elderly care. At the same time far from reclaiming control of the border with Ireland, the Northern Irish Protocol has poisoned the UK’s relationship with its EU neighbours even further.
- Fiscal independence: the proposed financial dividend from no longer having to make contributions to the EU and the ability to reclaim our fiscal independence has been recently exposed by the new UK Prime Minister Liz Truss. Confidence in any economy is hard won and all too easily lost. Such are the very obvious weaknesses of the post-Brexit economy, that the markets were already on edge. It took a small, but misguided, announcement by the new PM to push things over the edge. There is no better example of how expose the UK is now that it is on its own.
- Deregulation: almost every industry in the UK had spent decades conforming to EU regulations, and had frequently complained about having to do so. However this was now a sunk cost that could not be recouped, but at least it gave us access to the largest single market in the world. In many sectors these industries are now having to complete further regulatory requirements in order to export to the EU from a foreign country. To add to the ‘brexiteer’ nonsense, we are being told that a new set of British regulations are being cooked up just for us. Far from benefitting from the replacement of any EU red tape, UK businesses are facing additional costs on all fronts which will be amplified by simultaneously having to comply with increasingly divergent regulations from both the EU and UK. One area in particular that has been identified for reform has been data protection – with UK politicians vilifying GDPR.
Wonky Deregulation Economics
In a desperate attempt to find anything that could be reasonably described as a benefit from Brexit, the government is looking for regulations and red tape that can be dispensed with. However government ministers, policy wonks and lobbyists appear to be a great deal better at identifying costs than devising more effective alternatives or considering the consequences of their own actions. Researchers based at Oxford University identified reducing red tape as a means of unlocking economic growth. The paper estimated that GDPR alone was responsible for reducing businesses profits by as much as 8%. It did not focus on the benefits of GDPR.
The UK government’s first attempt to reduce the burden of GDPR was outlined in the Data Protection and Digital Information (DPDI) bill. This was not received well and was criticised by many privacy and compliance professionals, who pointed out that the policy wonks simply didn’t understand how it works, in much the same way that they underestimated the customs overhead that would be caused by Brexit.
The argued benefits of the original DPDI proposals included amended rules for personal data processing in areas like consent for online tracking and data for scientific research as well as for public sector data use and sharing. It also promised to ease the regulatory burden of GDPR’s “one-size-fits-all” approach on small businesses. The role of Data Protection Officers was to be changed, along with that of the UK data regulator itself. The planned changes were projected to yield savings for UK businesses of more than £1bn over 10 years.
However, experts pointed out that any organisation doing business with the EU will need to continue to abide by the EU version of GDPR whatever. Thus rather than saving anything from the introduction of a simplified UK version, most businesses would actually face the increased overhead and cost of having to abide by two different regulations in parallel.
Adrift Without Leadership
While partial exemptions for small businesses were seen as promising, most other organisations questioned the need for divergence from EU regulations that will also apply to them anyway, especially when any such reform could call into question the adequacy of UK data protection and its alignment with the EU version of GDPR.
The European Commission carries out a regular, detailed assessment of the UK’s laws and systems for protecting personal data to decide whether to designate UK legislation as adequate. The last evaluation round, cited the UK Home Office’s Investigatory Powers Unit as being in contravention of GDPR, but thankfully this was overlooked with the adequacy decision being made in the UK’s favour.
The US was less fortunate with intrusive extraterritorial legislation such as the Clarifying Lawful Overseas Use of Data (CLOUD) Act and secret FISA warrants leading to a challenge in the EU courts (known as Schrems II) which eventually overturned Privacy Shield, the data sharing agreement between the US and EU. The US is consequently treated as a third country for data transfers, just as the UK is for trade.
Recently however the US and UK have implemented a new data access agreement for data sharing between their respective law enforcement agencies to help to combat serious crimes in both countries. This could well be interpreted under the Schrems II ruling as extending the US’s intrusive extraterritorial laws and its mass surveillance regime to the UK.
With the UK’s adequacy decision expected to be reviewed again before it expires on 27 June 2025, any further alignment with the US or divergence from GDPR will be of great concern. And while alignment with the US may aid law enforcement, it won’t necessarily open the door to any transatlantic trade agreement. However, if the UK is unable to renew its data sharing arrangement with its nearest and largest trading partner, this will massively compound the cross channel difficulties already being experienced as a result of Brexit. The UK risks becoming a third country for both trade AND data sharing.
Time for a rethink
One of the governments recent U-turns (not its largest one by any stretch) was to out the DPDI bill on hold, while it rethinks its approach. The fear is that its fervour for reform and desperation to find some kind of benefit from Brexit may lead to another set of proposals that overplay the anticipated advantages of divergence, while failing to appreciate its potentially catastrophic consequences.