UK publishes framework for talks on post-Brexit EU-UK data flows

Trade in 'data enabled services' between the UK and EU is valued at more than £120 billion

The British government has published its ‘explanatory framework' for post-Brexit data flows between the European Union and the UK.

The series of 17 documents, published on Friday, provide an overview of the UK's legal framework for personal data.

"Adequacy decisions are the European Commission's legal mechanism to facilitate the free flow of personal data from the European Union to third countries. They can encompass data flows under the GDPR for general and commercial purposes and data flows under the LED [the Law Enforcement Directive] for law enforcement purposes," the Department for Digital, Culture, Media and Sport explains.

Delivered through Article 45 of GDPR and Article 36 of the LED, adequacy decisions confirm that the third country's data protection standards are ‘essentially equivalent' to those of the European Union. They are adopted on the basis of a positive assessment of the third country's data protection framework by the European Commission.

While the UK implemented GDPR, it was augmented by the Data Protection Act 2018, which both complemented GDPR and updated the Data Protection Act of 1998.

"The European Union (Withdrawal) Act 2018 (EUWA) incorporates directly applicable EU legislation into UK law. This includes the GDPR and is called ‘retained EU law'," the legislative framework document notes.

It continues: "Under the EUWA, Ministers have the power to introduce secondary legislation, via statutory instruments, to prevent or remedy any deficiencies in retained EU law that result from the UK's withdrawal from the EU."

As a result, the UK's main data protection legislation therefore consists of a combination of what's been called ‘UK GDPR', as incorporated under EUWA amended by regulation, and the Data Protection Act 2018.

An agreement on data protection flows between post-Brexit UK and the European Union is important for the economies of both blocs, especially with so much business and trade going electronic.

EU personal data-enabled services exports to the UK were valued at approximately £42 billion (€47 billion) in 2018, according to the government, while the value of exports from the UK to the EU were pinned at £85 billion.