EU warns it will do regular checks on UK data handling

Brussels on Friday warned it would impose “clear and strict” checks on the UK’s handling of personal data, flagging potential post-Brexit conflict even as it gave provisional approval for information to flow across the English Channel.

The European Commission said Britain appeared to offer “essentially equivalent” data protection standards to the EU, allowing the flow of information from the EU to the UK — a decision that will come as a relief to businesses and law enforcement authorities. 

But the draft ruling, if confirmed, will be reviewed every four years by Brussels and could be annulled should London be deemed to have departed from EU privacy standards. 

“We should ensure that our decision will stand the test of time,” said Vera Jourova, the European Commission vice-president for values and transparency.

The commission’s draft ruling is seen as highly likely to win the required sign-off by EU data protection authorities and the bloc’s member states.

I would not rule out the possibility of the approved UK adequacy decision being challenged in the future in a Schrems-style action

It will be welcomed by businesses — particularly in the health, insurance and technology sectors — that regularly transfer personal customer information such as bank details.

The move will also help with aspects of EU-UK law enforcement co-operation, although Britain has lost access after Brexit to the giant SIS II police database, which enables information sharing across the bloc, as well as the European arrest warrant network.

Oliver Dowden, UK culture secretary, welcomed the EU data decision and was relieved it had been taken on merit and not become enmeshed in wider political tensions around Brexit.

Although Boris Johnson, UK prime minister, is looking at possible areas of regulatory divergence from the EU after Brexit, Dowden’s allies said no such options were being examined in the area of data.

But the decision could still be vulnerable to changes in UK practices or to legal challenges at the European Court of Justice.

The EU’s top court struck down parts of the EU-US “privacy shield” data transfer arrangements last year, in a case brought by the activist Max Schrems.

Miriam Everett, global head of data and privacy at law firm Herbert Smith Freehills, said: “Given the level of complexity and political and legal uncertainty in this area, I would not rule out the possibility of the approved UK adequacy decision being challenged in the future in a Schrems-style action.”

The data decision came as Valdis Dombrovskis, EU trade policy chief, held separate talks in Brussels with Liz Truss, UK trade secretary, over potential co-operation on matters including World Trade Organization reform.

Truss’s visit tied in with the UK’s agenda as holder of the G7 presidency and was aimed in part at exploring possibilities for joint action on tougher enforcement of industrial subsidies curbs on China, said a British official.

London is also interested in presenting itself as a broker to help resolve disagreements between the US and the EU, such as the dispute over state aid for Airbus and Boeing, the aircraft manufacturers, added the UK official.

Truss made her trip against a backdrop of escalating UK-EU spats over trade rules since Britain left the bloc’s single market and customs union at the end of last year. 

Dombrovskis invited the UK to “co-operate closely with the EU in like-minded groups at the WTO”, said the European Commission. The EU is already part of a trilateral group with the US and Japan on WTO reform.