One of the EU’s privacy and data protection watchdogs takes issue with what it sees as the EU negotiating away fundamental rights in its deal with the UK over its EU exit.
European Data Protection Supervisor (EDPS) Wojciech Wiewiórowski has rendered his opinion on the European Commission’s (EC) proposed adequacy decisions on the United Kingdom (UK) that would permit the personal data of European Union (EU) residents to continue to be transferred from the EU to the UK as if the latter were still a member of the EU. The EU-UK Trade and Cooperation Agreement (TCA) that governs the UK’s exit from the EU provided for a six month grace period ending on 30 June 2021, for negotiators did not work out a number of details including how the UK would be treated visa vis the General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED). An adequacy decision is most desirable from a trade and business standpoint, and at present less than 15 nations operate under adequacy decisions with the notable exception being the United States (U.S.) as the EU’s highest court recently struck down the second EU-U.S. adequacy decision in the last decade.
Recently, the EC published the two draft adequacy decisions:
- Draft decision on the adequate protection of personal data by the United Kingdom – General Data Protection Regulation
- Draft decision on the adequate protection of personal data by the United Kingdom: Law Enforcement Directive
In its press release, the EC noted “[t]he publication of the draft decisions is the beginning of a process towards their adoption…[that] involves obtaining an opinion from the European Data Protection Board (EDPB) and the green light from a committee composed of representatives of the EU Member States.” The EC added “[o]nce this procedure will have been completed, the Commission could proceed to adopt the two adequacy decisions.” The EC further claimed:
- Over the past months, the Commission has carefully assessed the UK’s law and practice on personal data protection, including the rules on access to data by public authorities. It concludes that the UK ensures an essentially equivalent level of protection to the one guaranteed under the General Data Protection Regulation (GDPR) and, for the first time, under the Law Enforcement Directive (LED).
- After taking the opinion of the European Data Protection Board into account, the European Commission will request the green light from Member States’ representatives in the so-called comitology procedure. Following that, the European Commission could adopt the final adequacy decisions for the UK.
In the “EDPS Opinion on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement,” Wiewiórowski took issue with the process and the substance of the draft adequacy decisions. The EDPS recognized that the TCA cannot be re-drafted, and so he argued that its objectionable provisions must not be used in future trade agreements for they are counter to established EU law and the EC’s previously adopted position on trade and data protection.
As to the substance of the draft decisions, the EDPS noted a 2018 EC position reiterating that the data protection and privacy rights of EU residents cannot be negotiated in trade deals (i.e., the so-called “horizontal provisions”), for these rights are fundamental, and as such, cannot be abridged or changed as part of trade deals. The EDPS stated:
In amending the legal wording of the horizontal provisions, the TCA unnecessarily creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework.
The EDPS stressed his support for the horizontal provisions:
The EDPS supports the horizontal provisions endorsed by the European Commission in 2018, as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The horizontal provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter and the EU legislation on the protection of personal data. Furthermore, the Commission has repeatedly stated that these horizontal provisions are not up for negotiation.
The EDPS pointed to language in the TCA that does not identify the EU’s right to protect data as fundamental but rather characterizes this as a power the EU may exercise as incidental to data flows. The EDPS added the horizontal provisions were agreed upon so as to strengthen the EU’s hand should its rights to protect data and privacy be challenged under international law governing trade agreements. Wiewiórowski also pointed to language that seems to place provisions in the TCA barring data localization in the EU above the sovereignty and fundamental rights of the EU. Moreover, there is language the EDPS identifies that could be read as making the terms of the TCA supreme over EU law in determining how personal data would be transferred. The EDPS conceded that UK law is similar to EU law given its previous membership in the bloc but stressed the TCA must remain an exception and not the template for future deals governing the flow and protection of EU personal data.
The EDPS objected to provisions in the TCA that, in his view, treat adequacy decisions with the UK as fait accompli. However, what is more concerning to the EDPS is the current six month period that allows data to flow as if the UK were still in the EU without “the corresponding procedural safeguards” like “the GDPR ‘one-stop-shop’ mechanism or the supervision by the Court of Justice for the European Union (CJEU).”
The EDPS also asserted that international deals on trade and data protection and flows must remain separate with the latter occurring within the framework of EU law on data flows (i.e., the GDPR, LED, and others.)
On his objections to the the LED adequacy decision, the EDPS asserted:
As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS praises the Commission for the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. At the same time, he regrets that certain safeguards are missing both in the general provisions, which neither contain a categorisation of data subjects as set out in Article 6 of the Law Enforcement Directive nor more detailed and robust safeguards with regard to onward transfers and in the Prüm section in particular. He also would have wished the transitional period for the passenger name record data erasure be shorter than the possible 3 years and a list of serious crimes be included. He further recommends ensuring that any future changes in the Prüm framework between EU Member States leading to additional safeguards be fully reflected into the agreement and actually implemented by both parties.
Regarding the process by which the EU-UK trade agreement was reached, the EDPS contended:
The EDPS regrets that he was not consulted on the proposal for a Council Decision to sign these agreements, in accordance with Article 42(1) of Regulation (EU) No 2018/1725. He trusts however that this will remain an exceptional case which will not set a precedent for other on-going and future negotiations having an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data.
The EDPS is not the only EU data protection authority that must assess the adequacy decisions. The EDPB held a 10 March plenary session and explained in its recap of the meeting:
The Board discussed the draft UK adequacy decisions, which were received from the European Commission. The EDPB will thoroughly review the draft decisions, taking into account the importance of guaranteeing the continuity and high level of protection for data transfers from the EU.
Obviously, there was no timeline discussed under which the EDPB would make known its views on the draft decisions. However, the EDPB’s opinion must be issued before the next steps in the consideration of the adequacy decisions can be taken under which EU member nations make their concerns known.
© Michael Kans, Michael Kans Blog and michaelkans.blog, 2019-2021. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Michael Kans, Michael Kans Blog, and michaelkans.blog with appropriate and specific direction to the original content.
Image by Marshall Rice from Pixabay
Michael Kans 