The UK’s new, bold approach to international data transfers

Our world has never been smaller. The power of digital technology can bring families together, unlock new markets for businesses and help deepen international relationships between nations.

The fact you could be reading this in India, Australia, Kenya or Colombia is testament not only to the breadth of Privacy Laws & Business’ readership but also to the global importance of international data flows.

As the UK Minister for Media and Data, I want to set out the UK’s approach to international data transfers and update on progress relating to EU-UK data flows.

Why are data transfers important?

Our hyper-connected world is increasingly reliant on data transfers. Everyday conveniences such as GPS navigation, smart home technologies and content streaming services rely on data transfers. They have modernised our way of life, helped enable us to make informed choices and use our time more efficiently.

The pandemic has also forced us to share data quickly, efficiently and responsibly for the public good. We saw this happen with the hospital trusts which shared lung scans to improve coronavirus treatment methods, and we are determined to use these lessons to capitalise on the potential of data.

Flows of data across borders underpin almost all economic activity as well as vital scientific research. They help power effective law enforcement cooperation, national security capabilities and the delivery of public services. In 2018 the UK exported £190 billion in services delivered digitally and in 2019 investments in the UK tech sector soared to £10.1 billion – a £3.1 billion increase on 2018’s figures and the highest level in UK history.

In the financial sector, service providers analyse data generated across the world to detect patterns, identify and stop fraudulent transactions, and help combat other criminal behaviour. In health care it also supports the delivery of more cost-effective bio-pharmaceutical research, and the development of new life-saving treatments. From a personal perspective, data transfers have enabled us to stay connected to friends, family and communities.

The UK's approach

I believe there is a great opportunity for the UK to make use of its independent powers to deepen our strategic international relationships and forge new bilateral and multilateral alliances. As set out in our National Data Strategy, we will champion the international flow of data, seeking to enable secure, trusted and interoperable exchange across borders, while continuing to protect data to high standards.

Given the fragmented nature of global data policy, the UK can show creative leadership and influence to help promote the development of international rules. We will make the case for removing unnecessary barriers to data flows, where the significant benefits of growth and innovation are put at risk by more protectionist forces. Our international strategy will also explore ways in which we can use data as a strategic asset in the global arena and improve data sharing and innovation between our international partners. We want to shape global thinking and promote the benefits of the secure international exchange of data that will be integral to global recovery and future growth and prosperity.

We have a proud, strong and longstanding commitment to high standards of data protection. In the 1970s the UK developed pioneering committees to explore the protection of personal data and in 1981 we were one of the first to sign Council of Europe Convention 108, the first binding international instrument to protect individuals with regard to the automatic processing of personal data. More recently the UK played an active role in developing the GDPR and Law Enforcement Directive. Our commitment to high standards of data protection applies not just to the protection of personal data in the UK but also to when that data is transferred overseas. In light of the ubiquity and importance of international transfers, it is important that mechanisms that facilitate such transfers are built with high standards of data protection front of mind.

Having left the EU, the Secretary of State for the Department for Digital, Culture, Media and Sport now holds powers to make independent UK adequacy arrangements with new partners around the world, making it easier for organisations to send data internationally. He, and the Information Commissioner’s Office, can also deliver innovative alternative mechanisms for international data transfers. There is a huge prize to be won here.

Adequacy assessments

Data adequacy is the most straightforward mechanism for transferring personal data. Adequacy removes the need for UK organisations to use alternative transfer mechanisms, which can be costly to implement. It can also provide greater certainty and confidence in the regulatory landscape of another country.

Data adequacy requires a technical assessment of another country’s data protection laws and practices. It’s important we do this in ways that inspire trust and confidence in individuals, organisations and our international partners. We will take into account, amongst other things, the rule of law, respect for human rights and fundamental freedoms, and the existence and effective functioning of a regulator. Adequacy is about ensuring the level of protection under the UK GDPR is not undermined when data is transferred to a third country, and considering the overall effect of a third country’s data protection laws, implementation, enforcement, and supervision.

There is a world of opportunity out there. As Privacy Laws & Business has reported: 145 countries now have data protection laws (PL&B International, February 2021, p.1). No two countries have identical laws and practices – not even the EU Member States apply European data protection laws in exactly the same way. The UK will pursue an outcomes-based approach that will recognise, and indeed embrace, the fact that sovereign countries will use different means to protect data.

We acknowledge that data protection and privacy are inherently cultural issues. We also understand the responsibility that governments have to keep their citizens safe. And we will also be taking a respectful and considerate approach to sensitive issues such as national security.

Currently UK law treats as adequate the EU and EEA Member States, as well as the following 13 countries: Andorra, Argentina, Canada, the Faroe Islands, Gibraltar, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, Switzerland and Uruguay.

We intend to expand the list of adequate destinations in line with our global ambitions and commitment to high standards of data protection. Doing so will provide both UK organisations and our international partners with more straightforward and safe mechanisms for international data transfers.

To ensure our law provides confidence and certainty as to the protection of personal data, the Secretary of State will continue to monitor these matters, and undertake periodic reviews.

We will also be engaging constructively to remove unnecessary barriers to transfers of data to the UK, from our international partners beyond the EU. Securing and enhancing inbound flows of data to the UK will bring new opportunities for innovation, collaboration and trade, especially in data intensive sectors like scientific research, financial services, and artificial intelligence. The greatest benefits of international data flows will be realised when data can flow freely and securely in both directions.

Alternative transfer mechanisms

In today’s global marketplace data needs to be transferred everywhere and so we must supplement the adequacy process—which will not always be the right tool for the job. We have already in law a number of alternative transfer mechanisms, a “toolkit” for ensuring data is appropriately protected when transferred outside the UK. There exists plenty of flexibility within this toolbox to cater to the transfer needs of organisations in the private and public sectors.

The UK’s Information Commissioner recently demonstrated this flexibility already in the system when it addressed concerns around legal barriers to transfers from UK-based asset management firms to the US Securities and Exchange Commission. It was a great example of what a solutions-orientated approach can achieve when confronted with complex data transfer issues.

Now that the UK has left the EU, we will develop a toolkit that is based around the data rights and approaches in UK law, removing the unnecessary bureaucracy in the system, to focus on getting the right outcomes for data protection. It is also an opportunity to exploit this inherent flexibility to create a more globally interoperable model for data protection that works in harmony with other privacy systems.

EU-UK data transfers

I welcome the European Commission’s February publication of draft data adequacy decisions for the UK, which rightly reflect our high data protection standards and paves the way for their formal approval. That moment marked the culmination of many months of constructive talks during which the UK has comprehensively and clearly set out its robust data protection framework.

The draft decisions will now be shared with the European Data Protection Board for a non-binding opinion and the European Parliament before being presented to Member States for formal approval. I urge the EU to fulfil its commitment in the agreed declaration and complete the process promptly.

As part of the UK/EU Trade and Cooperation Agreement, a time-limited ‘bridging mechanism’ for personal data flows was agreed. This currently allows personal data to continue to flow as it did before the end of the Brexit transition period for up to six months, while the EU completes the adequacy approval process.

Conclusion

This is an exciting opportunity for the UK and one which I’m confident will see us create and deliver a globally-trusted and scalable approach to international data transfers. We will be publishing more information on our work over the coming months and we look forward to working with and hearing from stakeholders as we do so.

Our objective is for personal data to flow as freely and as safely as possible around the world, while maintaining high standards of data protection.

And, as we emerge from the pandemic, data will continue to play a vital role in enabling nations, people and economies to recover and will be central to our plans to build back better and fairer.

March 2021