UK and US announce a “data bridge” as part of The Atlantic Declaration



On 8 June US President, Joe Biden, and UK Prime Minister, Rishi Sunak issued their Atlantic Declaration. This includes an announcement of a “data bridge” as one of its many economic elements.

Both countries are “committed in principle” to establish the data bridge and both refer to the Global Cross-Border Privacy Rules Forum. But there are differences between the UK and US announcements - from the UK Secretary of State for Science, Innovation and Technology, Chloe Smith MP, and the US Secretary of State for Commerce, Gina M. Raimondo.

The US announcement includes the aim to “facilitate data flows between our countries while ensuring strong and effective privacy protections” without indicating how this objective will be achieved. There is a reference to “trust in the digital economy” and the OECD’s Declaration on Government Access to Personal Data Held by Private Sector Entities, but nothing on any privacy protections at federal or state levels.

The UK announcement is more nuanced in that it acknowledges the EU context by stating: “This announcement represents the UK’s intent to establish a data bridge for the UK Extension to the EU-US Data Privacy Framework.” This Declaration is conditional on several factors:

  1. “subject to the UK’s data bridge assessment and
  2. further technical work being finalised, and
  3. dependent on the US designation of the UK as a qualifying state under Executive Order 14086.”

The “mutual ambition to establish a data bridge that would restore a robust and reliable mechanism for UK-US data flows” suggests that it would survive even if the EU-US Data Privacy Framework is challenged in the Court of Justice of the European Union. Everyone should assume that there will be a Schrems III case because Max Schrems says so.

The UK side, probably mindful of its aim to retain its EU adequacy declaration, explicitly declares that the “data bridge would uphold the rights of data subjects.” It then adds the business goal that it would “facilitate responsible innovation.”

The UK declaration continues “We expect that the establishment of the data bridge will also further facilitate transfers to US organisations that rely on other data transfer mechanisms under UK law” presumably referring to Binding Corporate Rules or Standard Contractual Clauses, but without mentioning specific mechanisms.

In short, while this Data Bridge has a certain positive symbolism, we will have to wait and see which privacy protections will have substance and when.

See:

These issues will be covered in sessions with speakers from the European Commission, France, the UK and the US at Who’s Watching Me?, PL&B’s 36th Conference, 3-5 July.