The UK government ran a cross-sector consultation on the UK National Data Strategy from 9 September 2020 to 9 December 2020. The business community is eagerly awaiting the publication of the response to that consultation.
Cross-border data transfers are a vital component of that strategy. The country enjoys a £10.2bn surplus in trade in telecommunications.
[1] In a broader sense, the Department for International Trade (DIT) and DCMS figures put UK digitally-enabled services exports at roughly ₤221 billion in 2018.
[2]
Beyond the numbers, the issue is at the heart of how businesses operate today: most businesses have a routine need to transfer data across borders, from cases like clinical trials to the more mundane like day-to-day data that enables offices to function – think of intra-company instant messaging for example.
In fact, when looking at the digital economy beyond a narrow Information and Communication Technologies (ICT) scope, data transfers affect virtually every sector, with a whopping 60% of global GDP expected to be digitized by the end of this year.
That is why it is encouraging to see that the UK government recognises the importance of data to the UK’s economy and society, looking at reforms to facilitate international data flows, while continuing to maintain a high standard of data protection.
We can expect to see some major developments by the end of 2021:
EU Adequacy for the UK
The EU’s Adequacy Decision process for the UK is in its final stages. On the 14th of April 2021, the European Data Protection Board adopted two Opinions on the draft UK adequacy decisions issued by the European Commission on 19 February 2021.
With a full three quarters of the global cross-border data flows traffic that the UK facilitates going to the EU
[3], the UK-EU data transfers partnership is clearly extremely valuable and should be maintained and strengthened.
As the UK’s own data protection rules are based on the European data protection framework, we should expect a positive decision over the next few weeks.
UK Adequacy Decisions
The government is aware that data adequacy decisions are the most straightforward mechanism for transferring personal data. Outside the EU, the UK is now free to make its own arrangements, and therefore it is looking to establish its own adequacy agreements with several countries and intends to take a more outcomes and risk-based approach to assessment.
In doing so, it is likely to prioritise major trading partners for adequacy decisions, as data closely follows trade and digital trade patterns in particular. As the UK’s single most important trading partner, the U.S. should be one of the first recipients of a UK adequacy decision, in coordination with the upcoming update to the Privacy Shield. Together, these elements would secure the transatlantic data transfers 'triangle' and bring much needed certainty to the broader economic corridor.
Beyond adequacy, alternative transfer mechanisms are a possible option for situations where it may not be possible to make an adequacy decision. The UK could also introduce its own standard contractual clauses (SCCs), which should be compatible with EU’s own in the interest of interoperability and facilitating business operations.
Looking Ahead
Three key points stand out:
- Businesses need a clear, pragmatic, and predictable regulatory environment.
- We need continued business engagement and dialogue so that policymaking addresses the practical experience of companies that transfer data across borders on a day-to-day basis.
- The UK is already a global leader on digital trade. The Presidency of the G7 offers a unique opportunity to deliver a clear message on modern digital trade rules. Together with the U.S., the UK should lead on enabling global data flows and preventing barriers such as data localisation.
***
[2] The Department for International Trade and The Department for Digital, Culture, Media, and Sport, "Understanding and Measuring Cross-Border Digital Trade," 14 May 2020, available online here
