UK-US post-Brexit data flow agreement could water down regulation standards

Leaked documents suggest the Privacy Shield will eventually make way for a much deeper trans-Atlantic relationship

Obtaining commitments that guarantee the free-flow of personal data across the Atlantic is a "top priority" for the US in any discussions with the UK over a future relationship post-Brexit.

Leaked trade discussions suggest the US is lobbying to establish watered-down regulations between itself and the UK for international data transfers. This would be enforced in such a way that a set of common standards will be in place, but there would be no need to harmonise domestic laws, as the General Data Protection Regulation (GDPR) requires.

Advertisement - Article continues below

US representatives, moreover, also see no legal reason why the UK can't commit to free data flows in this way while also guaranteeing adequate data protection domestically under legislation such as GDPR. The Data Protection Act 2018 will apply in the UK once the UK leaves the EU.

Documents highlighted by the Labour Party during the 2019 general election campaign revealed that pharmaceutical matters were being discussed between US and UK trade representatives. The same cache of documents, however, also outlined discussions on other issues ranging from food standards to data protection.

The documents suggest the UK has committed to abiding by the EU-US Privacy Sheild in the immediate future following EU withdrawal and during the transitional period, which should give both parties the time to establish a future agreement. 

Advertisement - Article continues below

Depending on the nature of Brexit, the UK would first need to establish an adequacy agreement with the EU, however, to ensure the free flow of data continues undisrupted. The Information Commissioner's Office (ICO) has warned a no-deal Brexit, for instance, would block critical data transfers as there wouldn't be enough time to establish such an agreement.

There could also be a regulatory arrangement in the mould of GDPR's one-stop-shop principle that would appoint a lead regulator to adjudicate data protection violations.

Advertisement - Article continues below

One DCMS official stressed that attempting to forge free flow of data with non-EU countries, like the US, won't undermine efforts to secure an adequacy agreement with the EU. US representatives agreed there was no legal reason to suggest otherwise, citing arrangements that countries like Japan have in place.

On the potential future relationship, US representatives cited the Asia-Pacific Economic Cooperation-Cross-Border Privacy Rules (APEC-CBPR) agreement as a model the two nations could follow. This is a system that ensures the free-flow of data between borders in Asian countries by enforcing a set of common standards. 

"The suggestion of deep co-operation and a "One Stop Shop" for companies subject to both UK and US regulators will sound particularly attractive to many transatlantic groups," said the chairman of the data protection forum and partner at law firm McDermott Will & Emery, Ashley Winton.

Related Resource

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

"Finally, there is a suggestion that we could abandon the GDPR rules for legitimising the international transfer of personal data and follow the APEC Cross-Border Privacy Rules (CBPR) certification.  

Advertisement - Article continues below

"By APEC's own admission the APEC-CBPR is not as comprehensive nor as strict as the GDPR, it principally facilitates the international transfer of personal data and is does not harmonise domestic law."

The ICO favours arrangements that guarantee the export of personal data from the UK to the US where US firms comply with GDPR principles, he added. The free flow of data under CPBR arrangements "would certainly cause eyebrows to be raised in Brussels", however.

"This arrangement is not without precedent," Winton continued. "Japan has both adequacy under the GDPR and is a signatory to the APEC-CBPR, however, the greater concern is likely to be that adoption of the CBPR arrangements for transfer of personal data to the US would upset the adequacy determination that the UK is seeking to permit EU-UK transfer."

The US also has concerns with how GDPR is being implemented, the documents reveal, with representatives claiming the adequacy mechanism is a "flawed system" that cannot become a global standard, and is difficult for developing countries to adopt. 

IT Pro asked the Department for International Trade (DiT) to comment on whether future data-sharing arrangements with the US could risk undermining the UK's attempts to reach an adequacy agreement with the EU.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now



UK government may trace COVID-19 patients using mobile phone data

20 Mar 2020
General Data Protection Regulation (GDPR)

Irish data regulator racks up GDPR cases against Big Tech

24 Feb 2020
data management

EU-US data transfer tools used by Facebook ruled legal

19 Dec 2019

Arcserve UDP 9240DR review: Beef up your backups

4 Apr 2019

Most Popular

video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020