Source: https://publications.parliament.uk/pa/cm201719/cmselect/cmexeu/1564/156402.htm
Timestamp: 2019-04-26 14:36:51+00:00

Document:
1.The Committee on Exiting the European Union published its Seventh Report of Session 2017–18, The progress of the UK’s negotiations on EU withdrawal: Data, (HC 1317), on 3 July 2018. On 6 September 2018, the Committee received the Government response to the Report. It is appended below.
The UK is a global leader in strong data protection standards and protecting the privacy of individuals will continue to be a priority for the UK. The UK demonstrated this commitment with the successful passage of the new Data Protection Act 2018, which applies and implements the General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED) respectively in UK law. It further strengthens UK data protection standards, ensuring they are fit for the modern age, and implements the EU’s new data protection framework into UK domestic law. Our data protection laws will therefore be aligned with the EU’s at our point of exit.
As the Prime Minister said in her Mansion House speech, achieving a deal on data protection is one of the foundations that must underpin the UK-EU trading relationship. In a globalised digital economy, data flows envelop all trade in goods and services as well as other business and personal relations. They are critical for both sides in a modern trading relationship. The ability of law enforcement agencies to transfer data both within the EU and with third countries is crucial in our efforts to fight cross border crime and prevent terrorism.
The UK wants to secure an agreement with the EU that provides stability and confidence for EU and UK business, public bodies and individuals to achieve our aims in maintaining and developing the UK’s strong economic and security links with the EU. That is why we are seeking to build on the standard adequacy model and want to see ongoing regulatory cooperation and joined up enforcement action between UK and EU data protection authorities. This will ensure UK and EU businesses and citizens continue to benefit from greater cross-border cooperation for resolving data protection disputes.
As the Committee notes, under current arrangements, a third country can request the Commission considers them for an Adequacy Decision.
The Commission can then assess whether that country’s data protection rules, and the means for ensuring their effective supervision and enforcement, are sufficient to provide an adequate level of protection. In making its assessment of a third country’s data protection rules, the Commission will scrutinise that country’s domestic legislation and practice, as well as compliance with relevant international standards, in order to ascertain whether the data protection standards in the third country are ‘essentially equivalent’ to those applied in the EU (a test set by the Court of Justice of the European Union [CJEU] in its Schrems judgment). The UK will be assessed by the Commission against these standards.
The UK is ready to begin preliminary discussions on an adequacy assessment so that a data protection agreement is in place by the end of the implementation period at the latest, to provide the earliest possible reassurance that data flows can continue. The UK and the EU start from a position of trust in each other’s standards and regulatory alignment on data protection. We are strongly committed to protecting the personal data of all citizens and will continue to be a global leader in this area, as demonstrated by the passage of the Data Protection Act 2018. The Act strengthened UK standards in line with the EU’s General Data Protection Regulation (GDPR) and the Law Enforcement Directive, providing a unique starting point for an extensive agreement on the exchange of personal data that builds on the existing adequacy framework.
The EU’s adequacy framework provides the right starting point for the UK’s future relationship with the EU on data protection. However, the UK wants to build on this model in two respects. It would be mutually beneficial to have a clear framework to facilitate dialogue and support a stable relationship between the UK and EU to protect personal data. It would also benefit the UK and the EU to have close cooperation between the UK’s Information Commissioner’s Office and EU Data Protection Authorities.
On 22 May 2018, UK government officials presented slides to the European Commission outlining a framework for a UK-EU future partnership on data protection (available on gov.uk).2 A further paper was presented by the UK government to the Commission in June 2018, which set out the benefits to the EU of the UK’s proposals (available on gov.uk).3 These publications set out the distinction between what an Adequacy Decision can provide for and the additional benefits of the UK’s proposals.
The Prime Minister has been clear that by leaving the EU, we will end the jurisdiction of the CJEU in the UK. However, EU law and the decisions of the CJEU will continue to affect us and we will continue to follow the rule of law and abide by our international obligations. The UK will explore with the EU the terms on which we could remain part of the relevant bodies and the UK accepts that this would mean abiding by the rules of those bodies and making an appropriate contribution. If we agree the UK should continue to participate in an EU body, the UK would respect the remit of the CJEU in that regard. The UK Parliament would remain ultimately sovereign, and so could in principle decide not to accept these rules, but with consequences for our membership of the relevant body. As the Committee recognises, the UK is not seeking decision-making power over future EU laws, has no intention to impede EU policy making in data protection, and respects the fact that certain EU bodies are subject to CJEU jurisdiction.
In regard to our Future Security Partnership with the EU, the Security, Law Enforcement and Criminal Justice Future Partnership Paper5 published in September last year - as well as the presentation6 on the UK’s proposed Framework for the UK-EU Security Partnership and the recently published White Paper7—have been clear in setting out our ambitious vision for our future security relationship with the EU; one which protects our shared operational capabilities by providing for practical operational cooperation; facilitates data-driven law enforcement; and allows multilateral cooperation through EU agencies.
third countries is important to our collective security. It helps keep people safe by maximising the effectiveness of law enforcement agencies and bringing more criminals to justice.
The UK believes that the EU’s adequacy framework provides the right starting point for the arrangements the UK and the EU should agree on data protection, and we want to go beyond the framework in some respects. The UK and the EU start from a position of trust in each other’s standards and regulatory alignment on data protection.
As the Committee notes, the Commission has the ability to withdraw Adequacy Decisions and the CJEU has the ability to rule on the validity of Adequacy Decisions and data agreements. In the Schrems case, the Commission’s partial Adequacy Decision underlying the EU-US Safe Harbor agreement, was challenged (rather than the Adequacy Decision framework as a whole). The Commission sought to address some of the concerns raised by the CJEU in the Schrems judgment in the GDPR, which contains a new adequacy framework, including the requirement for regular reviews.
The UK is starting from a position of unique alignment with the EU’s data protection laws with the successful passage of the Data Protection Act 2018, which implements the EU’s new data protection framework in UK domestic law. The UK was fully involved in the drafting of GDPR and worked with Member States to shape it. The UK will continue to work closely with the EU and other partners to tackle future questions and challenges surrounding data protection.
9.The UK should accept the provisions in Title 7 of the draft Withdrawal Agreement providing assurance about the future protection of personal data already in the UK at the time of withdrawal. Following the passage of the Data Protection Act, the UK’s data protection law will be aligned with EU law on the day the UK leaves the EU. As a result, the UK will be in a very strong position when it seeks a declaration of essentially equivalent data protection. However, it is seeking an unprecedented agreement which will be subject to negotiation. The UK Government should be preparing for the adequacy process and ensuring that there is no risk of a gap in legal provision for transferring data between the UK and the EU after December 2020. This would have serious implications for businesses and consumers on both sides. The UK Government needs to establish with the Commission whether it is possible for the adequacy process to be initiated before the UK leaves the EU and, if so, to initiate the process without delay. It needs to provide concrete assurances that data will be able to flow between the UK and the EU after December 2020 on the same terms as now.
The UK Government is holding discussions with the European Commission on Title VII of the Withdrawal Agreement and we have made progress.
Both sides agree that it is important that the data and information, which has been exchanged before the end of the Implementation Period (and on the basis of the Withdrawal Agreement), is protected in accordance with high data protection standards. We want to move swiftly to discussing in more detail our future data protection partnership with the EU.
The UK Government believes it is in the best interests of citizens and businesses throughout the EU and the UK that we move quickly to provide the earliest possible reassurance that data flows can continue, uninterrupted, after the Implementation Period ends. That is why we have said that we are ready to begin preliminary discussions on an adequacy assessment straight away.
The UK agrees with the Committee that an agreement on data protection that provides for cooperation between data protection authorities would be mutually beneficial for both the EU and the UK.
As the Committee acknowledges, without an Adequacy Decision or new model in place, it is still possible for personal data to be transferred to third countries. The GDPR and the LED set out alternative methods of transfer, which companies and public authorities may use to transfer data to third countries in the absence of an Adequacy Decision. While these alternatives to adequacy are available under the EU framework, they may be costly and burdensome for data controllers and processors. The government will continue to engage with businesses, including in the digital and tech sectors, to help them understand how they would need to operate under a range of outcomes on data protection.
The process for an adequacy assessment is the same under the Law Enforcement Directive and the GDPR, and the UK is ready to begin preliminary discussions on an adequacy assessment straight away.
It is in the best interests of citizens and businesses throughout the EU and the UK that we move quickly to provide the earliest possible reassurance that data flows can continue. However, the shape of the future UK-EU data protection agreement is a matter for negotiations.

References: CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU