UK-US post-Brexit data flow agreement could water down regulation standards

Leaked documents suggest the Privacy Shield will eventually make way for a much deeper trans-Atlantic relationship

Numbers against dark background

Obtaining commitments that guarantee the free-flow of personal data across the Atlantic is a "top priority" for the US in any discussions with the UK over a future relationship post-Brexit.

Leaked trade discussions suggest the US is lobbying to establish watered-down regulations between itself and the UK for international data transfers. This would be enforced in such a way that a set of common standards will be in place, but there would be no need to harmonise domestic laws, as the General Data Protection Regulation (GDPR) requires.

US representatives, moreover, also see no legal reason why the UK can't commit to free data flows in this way while also guaranteeing adequate data protection domestically under legislation such as GDPR. The Data Protection Act 2018 will apply in the UK once the UK leaves the EU.

Documents highlighted by the Labour Party during the 2019 general election campaign revealed that pharmaceutical matters were being discussed between US and UK trade representatives. The same cache of documents, however, also outlined discussions on other issues ranging from food standards to data protection.

The documents suggest the UK has committed to abiding by the EU-US Privacy Sheild in the immediate future following EU withdrawal and during the transitional period, which should give both parties the time to establish a future agreement. 

Depending on the nature of Brexit, the UK would first need to establish an adequacy agreement with the EU, however, to ensure the free flow of data continues undisrupted. The Information Commissioner's Office (ICO) has warned a no-deal Brexit, for instance, would block critical data transfers as there wouldn't be enough time to establish such an agreement.

There could also be a regulatory arrangement in the mould of GDPR's one-stop-shop principle that would appoint a lead regulator to adjudicate data protection violations.

One DCMS official stressed that attempting to forge free flow of data with non-EU countries, like the US, won't undermine efforts to secure an adequacy agreement with the EU. US representatives agreed there was no legal reason to suggest otherwise, citing arrangements that countries like Japan have in place.

On the potential future relationship, US representatives cited the Asia-Pacific Economic Cooperation-Cross-Border Privacy Rules (APEC-CBPR) agreement as a model the two nations could follow. This is a system that ensures the free-flow of data between borders in Asian countries by enforcing a set of common standards. 

"The suggestion of deep co-operation and a "One Stop Shop" for companies subject to both UK and US regulators will sound particularly attractive to many transatlantic groups," said the chairman of the data protection forum and partner at law firm McDermott Will & Emery, Ashley Winton.

Related Resource

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

"Finally, there is a suggestion that we could abandon the GDPR rules for legitimising the international transfer of personal data and follow the APEC Cross-Border Privacy Rules (CBPR) certification.  

"By APEC's own admission the APEC-CBPR is not as comprehensive nor as strict as the GDPR, it principally facilitates the international transfer of personal data and is does not harmonise domestic law."

The ICO favours arrangements that guarantee the export of personal data from the UK to the US where US firms comply with GDPR principles, he added. The free flow of data under CPBR arrangements "would certainly cause eyebrows to be raised in Brussels", however.

"This arrangement is not without precedent," Winton continued. "Japan has both adequacy under the GDPR and is a signatory to the APEC-CBPR, however, the greater concern is likely to be that adoption of the CBPR arrangements for transfer of personal data to the US would upset the adequacy determination that the UK is seeking to permit EU-UK transfer."

The US also has concerns with how GDPR is being implemented, the documents reveal, with representatives claiming the adequacy mechanism is a "flawed system" that cannot become a global standard, and is difficult for developing countries to adopt. 

IT Pro asked the Department for International Trade (DiT) to comment on whether future data-sharing arrangements with the US could risk undermining the UK's attempts to reach an adequacy agreement with the EU.

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

1Password targets enterprise customers with Secrets Automation
IT infrastructure

1Password targets enterprise customers with Secrets Automation

14 Apr 2021
The definitive guide to IT security
Whitepaper

The definitive guide to IT security

9 Apr 2021
Ubiquiti insider says the company downplayed the severity of a major breach
data breaches

Ubiquiti insider says the company downplayed the severity of a major breach

31 Mar 2021
Forex broker FBS leaves millions of customer records exposed
data breaches

Forex broker FBS leaves millions of customer records exposed

25 Mar 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Roadmap 2021: What’s coming from 3CX
Advertisement Feature

Roadmap 2021: What’s coming from 3CX

30 Mar 2021