Brexit and adequacy... is a decision possible?

A recent Court of Appeal case has highlighted that, whatever the UK Government might say and wish for, getting an “adequacy decision” to allow free sharing of data once the UK leaves the EU is not a slam-dunk. As with most things Brexit-related, this may be a bumpy ride….

The GDPR broadly follows the model set out in the current Data Protection Act in relation to the export of data outside of the EEA - that is in order to be able to transfer personal data beyond the confines of the EEA, you have to meets certain pre-conditions.

There are a number of alternatives available, but for the purpose of this article we are looking at the ability to freely transfer personal data to countries that offer an adequate level of protection for for the rights and freedoms of individuals. It is for the EU to decide on what is or isn’t adequate.

Now, Theresa May has recently talked up what the UK is doing in the realm of data protection. She stated that “The UK’s Data Protection Bill will ensure that we are aligned with the EU framework. But we want to go further and seek a bespoke arrangement to reflect the UK’s exceptionally high standards of data protection. And we envisage an ongoing role for the UK’s Information Commissioner’s Office, which would be beneficial in providing stability and confidence for EU and UK individuals and businesses alike.” You can read the full speech here.

So far, so good - surely the EU can’t have a problem with a data privacy regime that goes further than GDPR? Well, this is where the Court of Appeal decision comes in.

The Court of Appeal has recently ruled that the (now expired) Data Retention and Investigatory Powers Act (DRIPA) is inconsistent with EU law. In short, the Court held that powers granted to law enforcement authorities for accessing communications data went further than was necessary for fighting serious crime. This, along with another case currently in the courts challenging DRIPA’s successor, the Investigatory Powers Act (IP Act), could mean significant amendment if the UK wants to get an “adequacy decision”.

So, why does it matter? Well, whilst it might appear remote and somewhat academic, with Brexit discussions on data sharing and adequacy between the UK and the EU, this case could have a big impact. If UK surveillance legislation is not compatible with the EU’s data protection law, then we could see any data sharing sharing between UK and EU law enforcement organisations at best be reduced to a trickle due to all the alternative bureaucratic hoops organisations would have to jump through or at worse, grind to a stand-still.

As with all things ‘Brexit’ we can only wait and see.