Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698927547683.pdf (United Kingdom)
TECHNICAL NOTE: BENEFITS OF A NEW DATA PROTECTION AGREEMENT Introduction 1.

A legally-binding data protection agreement between the EU and the UK will bring a number of important benefits to the EU: improved legal certainty, stability and transparency; • • better cooperation on enforcement and investigations for EU citizens; • cost savings and more efficient processes for EU businesses; and, • benefits to EU regulators, citizens and businesses from ICO’s resource and expertise.

2.
2.

These are benefits that a standard Adequacy Decision cannot provide.

They deliver better outcomes for EU citizens exercising their rights.

They reduce the costs for EU businesses.

They lower the risks of interrupted data flows.

They avoid duplication of effort and decreased cooperation between regulators.

3.

An agreement will not affect the EU’s ability to change its own data protection legislation, nor the EU’s decision-making autonomy.
The UK is not seeking decision-making power over future EU laws, has no intention to impede EU policy- making in data protection, and respects the fact that certain EU bodies are subject to CJEU jurisdiction.

Improved legal certainty, stability and transparency 4.

A legally-binding agreement would give a level of legal certainty and stability that an Adequacy Decision would not.
This level of certainty would be to the benefit of EU businesses and consumers who could be affected by the uncertainty and disrupted data flows, similar to the impact of the striking down of the EU-US Safe Harbor Agreement.

5.

A disruption in data flows with the UK would have major implications for EU interests.

• Unilateral Adequacy Decisions do not impose obligations on both parties, or an obligation to deal constructively with challenges.
By contrast a legally-binding agreement could oblige both sides to avoid as far as possible any disruption to data flows.

• A dispute resolution mechanism for solving problems before they escalate could be included, providing for an agreed handling process to minimise any disruption in the event of a legal challenge, for example.

• This would also provide transparency for EU citizens and businesses, making clear how governments would respond to challenges.
Given the importance of 1 predictable and stable data flows for the modern economy, and the scale of data flows with the UK, this transparency would be valuable for the EU’s economy.

• Continued close regulatory cooperation between EU and UK data protection authorities would ensure effective future enforcement, and so offer improved certainty and consistency for EU citizens and businesses.

6.
6.

Thus a key benefit of such an agreement, over a standard Adequacy Decision, is that we can negotiate the right governance mechanisms for our future data relationship.

This could include an agreed approach to the standards applied and their interpretation, and to enforcement and dispute resolution.

Cooperation on enforcement and investigations for EU citizens 7.
Concerns around data protection are increasingly prominent in public debate, with EU citizens rightly expecting their governments to protect their data.

Personal data flows between the EU and UK are huge, and affect wide areas of our citizens’ lives.
We need to maintain a level of regulatory co-operation that: • avoids unnecessary complexity and duplication; • removes any difficulty for EU citizens in enforcing their rights and gaining redress; and, • avoids EU citizens having to make complaints to both EU and UK regulators for the same breach.

8.
8.

This level of co-operation would support both GDPR Article 50, which requires the EU to cooperate with third countries for better cross-border enforcement, and the EU commitment to develop new approaches to cooperation with third countries on cross-border enforcement.
The Commission Communication of January 2017 on the exchange of data with third countries states that: “The Commission will… Develop international cooperation mechanisms with key international partners to facilitate effective enforcement.” Keeping it simple for EU citizens and companies 9.

EU citizens and companies will enjoy much simpler arrangements with the ICO still in the European Data Protection Board and the One Stop Shop.

10.
10.

To give an example, in the case of a major data breach in the UK affecting EU personal data, the One Stop Shop would allow a straightforward process, allowing a much simpler way for EU regulators to work with the ICO.

The ICO would provide UK expertise and proximity, and would conduct a fuller, more effective and quicker investigation than an EU regulator could.

A standard Adequacy Decision would not deliver this.

2 Cost saving and more efficient processes for EU businesses 11.
Any significant data breach by an EU company is likely to affect data subjects and businesses in both the EU and the UK, as well as involving websites from a range of different countries.

12.

Under a standard Adequacy Decision, the company would face investigation by both the EU and UK regulator as well as two sets of large fines - up to €20 million or 4% of global turnover - for the same breach.

13.

A legally-binding agreement which kept the ICO in the One Stop Shop would prevent this duplication.
It would mean that EU companies would only have to deal with a single regulator for any breaches that affected both EU and UK.

Benefits to EU regulators from ICO’s resource and expertise 14.

Continuing close regulatory co-operation would enable the continued contribution of UK resource, expertise and global influence.

• The ICO is Europe’s largest data protection authority.
It is highly respected by fellow regulators around the world, and carries a disproportionate share of the EU workload, for example, as the lead/co-rapporteur on 50% of the Working Party 29’s guidelines and approval of over 50% of Binding Corporate Rules.

• Many EU regulators have re-used the ICO’s domestic guidance.

Its absence from the EDPB would be keenly felt amongst fellow EU regulators.

• The ICO has a strong delivery record as an independent regulator.
It tackles difficult cases and issues large fines.

Its current caseload includes a UK Government Department and it is leading a high profile, global investigation into Cambridge Analytica in close cooperation with EU partners.

• The ICO contributes to the EU world-leading expertise and global influence.

It is an influential member of international bodies - the Global Privacy Enforcement Network and the International Conference of Data Protection Commissioners.
• It is a recognised international authority on the impact of new technologies on privacy rights.

Working in close collaboration with the ICO, EU partners can drive solutions to future challenges.

Why the UK should be treated differently 15.

The EU-UK relationship is much more than with any other third country.
The UK is: • unique in the depth, volume and scope of data flows with the EU; • in full compliance with EU data protection law, having implemented the GDPR and LED; • committed to the same high standards of data protection as the EU; and, • willing to enter into a legally-binding agreement to guarantee effective future enforcement.

3