Pixelbliss - stock.adobe.com

News

No-deal Brexit could lead to data issues, MPs told

Trade body TechUK is concerned smaller companies are far from ready for a no-deal scenario, while warning that leaving without a deal could lead to serious data issues for businesses

Lis Evenstad
By
Published: 31 Jan 2019 14:00

A no-deal Brexit is creating uncertainty for tech businesses and could cause serious issues with readiness and data, MPs on the Science and Technology Committee were told.

Giving evidence to the committee, trade body techUK’s head of policy for Brexit, international and economics, Giles Derrington, warned that while bigger companies have made preparations for a no-deal scenario, but it’s a different story when it comes to smaller companies.

“On the smaller side of the sector, the SME [small to medium-sized enterprises] side it is far more piecemeal,” he said, referring to a TechUK survey in December, which found that 65% of its smallest members had not taken any steps to prepare for no deal. “They don’t know what to prepare for.”

The uncertainty is also affecting how companies go about hiring new staff. “Quite simply we are already seeing some of the consequences. We have smaller, research-focused members, saying we don’t have enough certainty and therefore we’re not going to start firing people, but when people leave we’ll replace them in our German hub,” Derrington added.

Another issue is around data flows and processing. The government has suggested firms to go through their contracts to ensure they have the standard contractual clauses in place, as without them, they won’t have a legal basis to transfer data from the EU to the UK.

“If you’re using EU citizen data to build an algorithm, be a part of an AI [artificial intelligence], or indeed any other purpose, you’ll have no legal basis to do this if you don’t have standard contractual clauses or any other legal framework,” Derrington said.

Leaving the EU without a deal will have a significant impact on data flows. However, while the government are asking businesses to prepare, discussions with the European Commission on data sharing between the EU and the UK have yet to begin.

In October, digital minister Margot James said that the UK is ready to commence discussions on a future adequacy agreement.

Should the UK end up leaving the EU without a deal, the government’s planning notice on a no-deal Brexit “should allow free transfer of data until an adequacy agreement is put in place”, James added. 

Legacy data issues

However, the no-deal Brexit planning notice warns that the legal framework for transferring personal data from organisations in the EU to organisations in the UK would have to change when the country leaves the EU. 

This means that although businesses will be able to continue to send personal data from the UK to the EU, and would “at the point of exit continue to allow the free flow of personal data from the UK to the EU”, it may not be the same for the other way around.

“We’ve been saying for a while that we would like the adequacy discussions to start as soon as possible. But the EU, as with everything else, is saying they won’t start the discussions until we are a third country. So, I’d be surprised if a decision could be made in under a year,” Derrington told the committee.

There are also issues relating to legacy data, which was transferred from the EU to the UK before Brexit.

“It’s entirely unclear to us, and we’re still waiting on an answer from DCMS [Department for Digital, Media, Culture and Sport] on what happens to that data, because some of that data is being used in algorithms, for example,” said Derrington. “Theoretically, the question could be that data is no longer here legally so you have to give it back.

“Now the question is that if you try to give it back, you have to understand which bits of data it is; if you try to delete it, you would have to understand what bits of data it is. And both of those are processing data, which would then be in breach of GDPR [General Data Protection Regulation], so we are not sure if we can touch it or if we have to close it off.

He added that “extracting bits of data from an algorithm is a bit like taking eggs out of a cake, it’s pretty much impossible”.

“We don’t yet know, and a lot of our members don’t know, how they are supposed to do it other than just warehouse it and leave it forever,” he said. “That would have quite a significant impact.”

Read more about Brexit

Read more on IT for government and public sector