Yesterday, Prime Minister Theresa May gave a much-trailed speech purporting to flesh out some ‘detail’ – that most hated and troublesome concept for Brexiteers. On data protection law and institutions, she said:
“But the free flow of data is also critical for both sides in any modern trading relationship too. The UK has exceptionally high standards of data protection. And we want to secure an agreement with the EU that provides the stability and confidence for EU and UK business and individuals to achieve our aims in maintaining and developing the UK’s strong trading and economic links with the EU.
That is why we will be seeking more than just an adequacy arrangement and want to see an appropriate ongoing role for the UK’s Information Commissioner’s Office. This will ensure UK businesses are effectively represented under the EU’s new ‘one stop shop’ mechanism for resolving data protection disputes.”
This basically summarises the UK’s position since last August:
“After the UK leaves the EU, new arrangements to govern the continued free flow of personal data between the EU and the UK will be needed, as part of the new, deep and special partnership. The UK starts from an unprecedented point of alignment with the EU. In recognition of this, the UK wants to explore a UK-EU model for exchanging and protecting personal data, which could build on the existing adequacy model, by providing sufficient stability for businesses, public authorities and individuals, and enabling the UK’s Information Commissioner’s Office (ICO) and partner EU regulators to maintain effective regulatory cooperation and dialogue for the benefit of those living and working in the UK and the EU after the UK’s withdrawal.”
It is pretty straight down the line UK positioning.
So, ‘you need us at least as much as we need you?’ Tick. Though I’d be surprised if the data flow volume is symmetrical.
‘Believe us when we say we’ll have perfect regulatory alignment while also making the UK more innovative and flexible?’ Tick. Despite its dicking around with the GDPR implementation – especially the huge carve-out that slashes data protection for any non-UK citizens – UK will at least start with a more or less guaranteed adequacy finding that says its data protection regime is enough for transfers to continue.
And ‘We will of course leave the EU and all its institutions, but still expect an influential role in determining future policy and EU law.’ Tick. Magnificent cake-ism, really. Entirely consistent with the rest of the UK’s negotiating stance. Theresa May really believes the 27 member states need the UK’s input on data protection so much, that they’ll let its regulator, the ICO, continue to take part in coordination procedures, and also continue to water down data protection for everyone else. [click to continue…]