For the thousands of businesses that rely on being able to shuttle digital information across the Channel, the waters are about to get very choppy.
At the moment data flows pretty much unimpeded between EU countries because all are governed by the same rules, the General Data Protection Regulation (GDPR).
But with the U.K. leaving, its data protection regime needs to get a stamp of approval from the European Commission to keep the data flowing.
Click Here: Bape Kid 1st Camo Ape Head rompers
The U.K. is bullish about the prospect of that happening. Data Minister John Whittingdale told POLITICO last week that he saw “no reason” why the country wouldn’t get a so-called adequacy decision — a certification that data protection standards are on par with those of the EU — from the Commission.
“I don’t think the EU has ever had negotiations about adequacy with a country which has been closer in terms of their own legislative protections than it has with the U.K.,” said the Conservative politician.
But the optimism may well be misplaced.
While the U.K.’s rules do currently align with the EU’s, Prime Minister Boris Johnson’s government has indicated that data protection standards in the country are likely to diverge from the GDPR after Brexit.
There are also concerns on the EU side that even if the U.K.’s regime is up to scratch, it will allow data transfers to third countries that don’t make the grade in privacy protections, potentially endangering EU data.
Yet above even these concerns, there is the issue of the U.K.’s spying powers.
Privacy advocates have long complained that the U.K. doesn’t have sufficient legal safeguards for spying, and that the intelligence powers put EU data at risk.
On Tuesday, the EU’s top court is set to rule on those powers — in a decision that could amount to a death knell for U.K. hopes of an adequacy deal.
The ruling will focus on the U.K’s data retention regime, or the legal conditions under which data from communications can be held and transferred to intelligence agencies.
In a non-binding opinion handed down in January, an adviser at the EU court said that national rules in countries such as the U.K. which require companies to retain communications data and provide access to security agencies come under EU law, and are contrary to EU law.
National governments, backed by the European Commission, have argued that the question of data retention should not be covered by EU law because it’s linked to national security — an area fiercely guarded as the competence of nations.
While the case also concerns Belgian and French law and will have ramifications across the EU, it is the U.K. that has the most on the line. A ruling that follows the adviser’s opinion, stating that the U.K.’s data retention regime falls afoul of EU law, would be a blow to the country’s ambition to get an adequacy decision.
“Any hope of adequacy could vanish on Tuesday if the [Court of Justice of the EU] confirms that U.K. authorities’ access to communications data is contrary to EU law,” said digital rights NGO Access Now’s global data protection lead Estelle Massé, who said the country’s current chances are “slim.”
An adverse decision would add to an already tough situation for U.K. officials trying to obtain a stamp of approval from the EU.
The same court in July knocked down a transatlantic data protection deal known as Privacy Shield, casting the U.K.’s spying powers in a negative light given that the country — a member of the Five Eyes intelligence-sharing alliance — are similar to those of the United States.
In the event of an adverse decision on Tuesday, the U.K. could turn to so-called standard contractual clauses as a backup legal mechanism to keep sending data back and forth to the EU. But the ruling on Tuesday could also cast a pall of uncertainty over those clauses.
“The problem for the U.K. is that it will be in the same place as the U.S. after Schrems II if the court goes out and says that British law does not meet EU standards. This will make an adequacy decision problematic without changes to U.K. surveillance law, but it will also render the use of [standard contractual clauses] questionable,” said Théodore Christakis, a European law expert at Université Grenoble Alpes.
There may be more trouble on the horizon for the U.K.’s adequacy hopes.
The country’s surveillance regime is in the dock at the European Court of Human Rights, too — a court that has a track record of wrapping British knuckles on spying. And an agreement between the U.K. and the U.S. on digital evidence sharing has also raised eyebrows in Brussels because it drops requirements for judges to authorize access to personal data.
Want more analysis from POLITICO? POLITICO Pro is our premium intelligence service for professionals. From financial services to trade, technology, cybersecurity and more, Pro delivers real time intelligence, deep insight and breaking scoops you need to keep one step ahead. Email [email protected] to request a complimentary trial.