Brussels to allow data to continue to flow to UK

Brussels is set to allow data to continue to flow freely from the EU to the UK after concluding that the British had ensured an adequate level of protection for personal information.

A draft decision by the European Commission, seen by the Financial Times, is expected to be approved this week. It will be welcomed by businesses — particularly in the health, insurance and technology sectors — that regularly transfer customer personal information such as bank details. 

The move will also help with aspects of EU-US law enforcement co-operation, although the UK has still lost access to the giant SIS II police database and European Arrest Warrant network.

A positive decision by Brussels on data sharing had been widely expected and would benefit both the EU and the UK. It would be periodically reviewed by the commission and is open to legal challenges at the European Court of Justice, such as the one that led to parts of the EU-US “Privacy Shield” data transfer arrangements being struck down last year.

The decision to grant data adequacy to the UK will face scrutiny by the European Data Protection Board before it can be implemented, but the body does not have the power to block the move.

Vera Jourova, EU vice-president for values and transparency, said the UK had a head start when striking a data adequacy deal compared with countries where the systems were “rather distant” from the European bloc’s.

“At the same time we should ensure that any adequacy finding concerning the UK will be future-proof,” she said. “We will need to be very vigilant that such developments do not undermine the level of protection we would have found to be adequate.”

The arrangement will be re-examined every four years to check that UK rules do not compromise the privacy of EU citizens, according to the draft decision. It will allow for data transfers on police matters such as search warrants and the interception of communications for preventing or detecting serious crimes.

UK law already allows data transfer to the EU. But a full adoption of the commission’s decision must take place before June 30, when the interim regime agreed after Brexit expires, to ensure continuity of data flows between the bloc and the UK.

The EU decision is far from the end of the story, as the experience with transatlantic data sharing shows. European companies have been left in limbo over information transfers to the US since the Privacy Shield judgment last year, in a case brought by the activist Max Schrems.

Since the end of the Brexit transition period on December 31 last year, EU-UK relations have been strained by new rules for the movement of goods between Great Britain and Northern Ireland border. Tension over the arrangements have been so high that the UK and the EU have discussed setting up a hotline.

Meanwhile London’s once-unquestioned dominance of European financial markets is being challenged by Amsterdam, Paris and New York.