UK presses on with post-Brexit data protection reform

Red flags

The SNP’s Carol Monahan warned that in its current form the bill threatens to undermine privacy and data protection, and that by potentially moving away from the adequacy concept in the EU GDPR, it gives weight to the idea that different countries can maintain data protection standards in different but equally effective ways.

“The only way that we can properly maintain standards is by having a standard across the different trading partners, but the bill risks creating a scenario where the data of EU citizens could be passed through the UK to countries with which the EU does not have an agreement,” said Monahan.

“The changes are raising red flags in Europe. Many businesses have spoken out about the negative impacts of the bill’s proposals. Many of them will continue to set their controls to EU standards and operate on EU terms to ensure that they can continue to trade there,” said Monahan.

“According to conservative estimates, the loss of the adequacy agreement could cost £1.6bn in legal fees alone. That figure does not include the cost resulting from disruption of digital trade and investments,” she added.

Privacy experts react

Marjius Briedis, chief technology officer at NordVPN, said: “By seeking to put clear water between itself and Europe over GDPR rules, the government is putting the personal privacy of UK residents at risk. Relaxing some data restrictions may benefit smaller companies but ultimately it has the potential to allow a consolidation of power among tech giants who already hold a huge influence over our lives. 

“Companies should be made more accountable when it comes to our information, but instead some of the government’s proposals reduce the need for transparency and could make it harder for people to find out how their data is being used.”

Briedis said he was additionally concerned that weakening key principles in the GDPR could make it easier for corporations to be negligent and open the door to ever-more massive data breaches.

“Millions of consumers are having their details legally collected and traded every day, so it’s vital that our data rights are prioritised. These plans, which tilt the balance in favour of advertisers and data brokers, may risk turning our individual freedoms into an afterthought,” he said.

Amanda Brock, CEO of OpenUK, was similarly unconvinced, saying that releasing UK businesses from red tape would only be beneficial if they can continue to work with EU citizens and their data across borders – as they currently can.

“The bill lightens the requirements of GDPR in a number of ways which could potentially be considered to make life easier for businesses. However, any business still dealing with the EU will still have to meet GDPR requirements, so it is questionable whether a distinct regime will actually give UK businesses real benefits,” said Brock. 

“Changing the rules takes a risk with the adequacy ruling. For most businesses in a digital world, GDPR still has to be complied with. Setting it out so quickly after the Northern Ireland agreement has been reached is probably no surprise, but it's definitely leaving UK business to the whim of the EU on the Adequacy ruling.”

She added: “If the EU confirms the new lighter UK rules are effectively equivalent, then they effectively undermine the need for their own requirements under GDPR. This is a no win situation.”