In another knock to the UK’s Brexit hopes, the EU’s chief Brexit negotiator has said “no” to any automatic recognition of Britain’s data protection legislation, meaning the UK’s financial services sector could potentially lose access to EU data. The ability of the financial services industry to transfer personal data across different locations is crucial to its operations and is something which, for entities within the EU, has been facilitated by the Data Protection Directive (the “Directive”) (to be superseded from May this year by the General Data Protection Regulation (“GDPR”)).

The Directive, adopted by the EU in 1995 and implemented in the UK by national law, protects individuals’ right to privacy by regulating the processing of personal data by member states and enables the transfer of personal data across EU members. As Michael Barnier, the EU’s chief Brexit negotiator, remarked in his Business Europe Day speech:

“In the single market we have a modern and very detailed regulatory framework that allows for the 'free movement' of personal data … This facilitates the collection and exchange of such data. It also provides for supervisory mechanisms, overseen by the Court of Justice of the European Union.”

When the UK leaves the EU in March 2019, it will become a “third country” as far as EU data privacy legislation is concerned, meaning it will have to comply with the same market access rules and restrictions as countries outside of the EU. Consequently, financial services firms authorized in the UK will no longer be able to take advantage of ‘passporting,’ pursuant to which firms which are authorized to carry out certain activities by the regulator of one EU member state can carry out the same activities in other EU member states, without requiring the individual authorisation of each member state.

The UK had been keen to replicate the EU’s data protection laws post-Brexit, in attempt to maintain the free movement of data across the EU. Theresa May had suggested that if the UK financial regulator implemented the same regulatory standards as the EU regulator (i.e. equivalent to the GDPR), UK-based financial firms should be allowed to continue to operate freely with other member states. However, Mr. Barnier’s declaration is clear and leaves no room for optimism on the issue:

“In the absence of a common discipline, in the absence of EU law that can override national law, in the absence of common supervision and a common court, there can be no mutual recognition of standard.”

Given the fundamental role of data within international trade, and the fact the UK’s data economy (according to the Confederation of British Industry) is worth a potential £240bn, the implications of Mr. Barnier’s words for the UK and businesses operating within it are significant and did not go unnoticed by Philip Hammond, the UK Chancellor of the Exchequer, who noted shortly after Mr. Barnier’s speech that there should be “no illusion about the significant additional costs that would be borne if [the financial services] market were to fragment.”

The EU’s unwillingness to accommodate the UK in this respect has potentially far-reaching ramifications on UK economy as a whole, and will be seen by many as a further example of the EU trying to punish the UK for Brexit. Spectators will no doubt be waiting eagerly to see what Britain’s next move in its ongoing negotiations with the EU will be, particularly in respect of data and the financial services industry.