EU-UK Data Flows, Brexit and No-Deal: Adequacy or Disarray?

Abstract

This paper addresses data flows between the EU and the UK, focusing on the economic sphere. Data flows freely between the EU and the UK, and it has done since the emergence of the modern internet and digital economy. The free flow of data within the EU is enabled by harmonised data protection rules and common systems of regulatory enforcement. EU Member States also have shared arrangements for data flows with non-EU (i.e. third) countries. 75% of the UK’s international data flows are with the EU, and much UK economic activity is dependent on these flows.

No-deal means no adequacy decision and significant disruption to EU-UK data flows. This would place immense compliance burdens on individual organisations, which would have to invest in legal and administrative fees to ensure EU-UK data transfers remained lawful. Increasing the cost of business slows the growth of many organisations and undermines innovation. Over the long term, it could also lead to the UK being less attractive to investors and thus generate negative knock-on effects for the UK economy.

There has been intense political focus on the issue of trade in goods, particularly as regard the border with Ireland. By comparison, issues relating to data flows and trade in services more broadly have been neglected. Yet they may be as important for the economy, especially in future.

This paper is based on over fifty interviews with EU and UK policymakers, regulators, lawyers, business leaders and analysts. It outlines the EU’s legal and policy approach to data protection, giving an overview of the GDPR and the EU data governance framework. It then gives an overview of EU-third country data relationships, including the EEA, adequacy decisions, partial adequacy and countries with no formal arrangement. Finally, it places the post-Brexit UK in this context, assessing whether or not the UK is likely to get an EU adequacy decision, and what it means for the economy if it does not.

This paper asks:

- What are EU-UK data flows and why are they important?

- How does data flow between the EU and third countries?

- Will the UK get an adequacy decision?

- What does no-deal mean for data flows?