On August 24, 2017, the UK’s Department for Exiting the European Union (“the Department”) published “A Future Partnership Paper” (“Partnership Paper”) in which it outlined its approach on the exchange and protection of personal data with the EU in the post-BREXIT area. According to the Partnership Paper, one of the UK’s key goals is to agree with the EU at an early stage of the exit negotiations that the free flow of personal data between the UK and the EU will provisionally continue after BREXIT until such time as new and more permanent arrangements come into force. Whether the EU is willing to follow this approach is uncertain.

The free flow of personal data between the EU and the UK is vital for the UK’s economy. According to the Partnership Paper, 75% of the UK’s cross-border data flows are with EU countries. The UK also has the largest internet economy as a percentage of GDP of all the G20 countries. Moreover, data and data flows play an important role in the UK’s traditionally strong service sectors. The UK has, therefore, a genuine interest that BREXIT does not disrupt cross-border data flows to avoid the risk of companies deciding to move their servers from the UK to an EU country.

In the Partnership Paper, the UK suggests developing a unique UK-EU model for the exchange and protection of personal data, which goes beyond the existing EU adequacy model in certain aspects. Specifically, the UK suggests that (i) the regulatory cooperation between the EU and the UK should survive BREXIT; and (ii) the parties should ensure the certainty and stability of data flows at an early stage of the exit negotiations by mutually recognizing each other’s data protection frameworks:

• Regulatory cooperation: In the Partnership Paper, the Department advised that the UK does not only want the EU to consider the UK’s data protection level “adequate” after BREXIT, but also wants the EU to enable the UK’s data protection agency - the Information Commissioner’s Office or “ICO” - to play an ongoing role in the EU regulatory fora, also with respect to “future challenges.” Therefore, the UK would “be open to exploring a model which allows the ICO to be fully involved in future EU regulatory dialogue” in order to share, among other things, the ICO’s resources and expertise with the network of EU Data Protection Authorities.
• Ongoing certainty and stability: Given the fact that, at the point of exit, the UK’s data protection legal regime will have fully implemented the EU framework, including the General Data Protection Regulation and the Data Protection Directive (relating to personal data being processed for law enforcement purposes), the UK further suggests that the parties should mutually recognize each other’s data protection frameworks right at the beginning of the exit negotiations. The UK considers that early certainty around how current provisions can be extended, alongside an agreed negotiating timeline for longer-term arrangements, would assuage business concerns on both sides.

The UK does not only want to maintain data flows between the EU and the UK, but also between the UK and third countries with existing EU adequacy decisions. In this respect, the Department confirms in the Partnership Paper that the UK will also remain after the withdrawal “a safe destination for personal data with some of the strongest domestic data protection standards in the world” and, therefore, “does not see any reasons for existing data flows from third countries to the UK to be interrupted.”

It remains to be seen whether the EU buys into the proposal or rather considers it a “nice try.” So far, the EU has not commented on the Partnership Paper. Whilst it is likely that the UK will be considered a country with an adequate level of data protection at some point in time, it is fair to assume that the EU might not want to give away its leverage too early in  the exit negotiations. It is therefore somewhat unlikely that the EU will make any concessions prior to the conclusion of a more permanent agreement. Companies should therefore anticipate that the legal uncertainties regarding the future relationship between the UK and the EU regarding data protection issues will continue for some time into the future.