The Exiting the European Union parliamentary committee states that the UK should start adequacy talks with the EU as soon as possible. The Committee says that the chances of an adequacy decision, and a close involvement in how data protection laws evolve in the future, would be enhanced by the UK accepting the jurisdiction of the Court of Justice of the European Union in data protection law. This might help secure a future role for the UK's Information Commissioner on the European Data Protection Board, which is highly desirable if the UK wants to be involved in how EU data protection law evolves in the future.
But the government issued a technical note in June in which it argues that a legally binding agreement would be more beneficial both for the UK and the EU than an adequacy decision. A legally-binding agreement would keep the ICO in the One Stop Shop and EU companies would have to deal with only a single regulator for any breaches that affected both the EU and the UK.
In the future, the government would seek to sign a Treaty negotiated with the EU, rather than an adequacy decision made by the European Commission.
Speaking at PL&B’s 31st Annual International Conference in Cambridge on 3 July, Elizabeth Stafford, Head of EU Data Flows, at the Department of Digital, Culture, Media and Sport, agreed that in any case, an assessment of the UK’s data protection regime will be made by the European Commission. She said that even after the withdrawal agreement, the GDPR will continue to apply. “We are confident that the withdrawal agreement will be reached in time.”
She stated that the UK has much to offer. If the ICO is involved in investigations involving both the UK and EU businesses, the process will be quicker. The ICO has resources to conduct investigations and is able to develop niche areas of expertise. It has approved more Binding Corporate Rules applications than any other EU national DPA and has been involved in drafting 50% of the guidance by the DPAs in European Economic Area.
Bruno Gencarelli, Head of International Data Transfers and Protection Unit at the European Commission, said that of the different tools available, an adequacy decision is the cheapest one for companies to use so that is what we should try to have. But the UK will become a third country after the transitional period.
However, there is not yet a formal decision on a transitional period. There is still the possibility that the UK will crash out with no arrangement with the EU and no adequacy finding, David Smith, Special Advisor at Allen & Overy, said.
PL&B’s 31st Annual International Conference took place 2-4 July 2018. Read reports of conference sessions in the July issues of PL&B UK and International Report. The dates for next year’s conference are 1-3 July 2019 at St. John’s College, Cambridge.