techUK and ZIPSEE Digital Poland have today published a joint paper which outlines the importance of data transfers between the UK and Poland and calls for the continued free flow of data between the UK and Poland post-Brexit.
Once the UK leaves the EU the automatic ability for personal data to flow between the UK and EU Member States will come to an end. In an increasingly digital economy, the transfer of personal data has become crucial for businesses of every size and sector. Ensuring the continued free flow of data has been a priority issue for techUK ever since the 2016 EU referendum result given the importance to the technology industry and the wider economy.
Data transfers between the UK and Poland support a close relationship between the two countries. As the paper sets out, this includes supporting Poland’s increasingly digitised automotive industry, and high levels of tourism between the two countries. Overall the UK accounts for 11.5 per cent of global data flows, 75 per cent of which are with the EU.
techUK has been clear, including in a joint report published with UK Finance in November 2017 which you can see here, that the best solution to ensure frictionless data transfers can continue is through mutual adequacy agreements between the UK and the EU. Adequacy agreements allow personal data to be transferred between third countries and the EU, once a full assessment of domestic data protection laws has taken place.
At this stage in the Article 50 process it remains unclear what the UK’s future relationship will be with the EU. The recently defeated Withdrawal Agreement would have allowed data to continue to flow during the transition period, and the Political Declaration contained a commitment from both the UK and EU to agree adequacy by the end of the transition period. These commitments were welcomed by techUK.
In the event of No Deal between the UK and the EU, the UK Government has stated it would declare the EU adequacy given both have the same high level of data protection through the General Data Protection Regulation (GDPR). However, the European Commission has confirmed that in the event of No Deal businesses transferring data from the EU, including Poland, to the UK will have to rely on alternative mechanisms set out in GDPR. The joint techUK and ZIPSEE paper sets out the problems with these alternative mechanisms and contains two recommendations for the European Data Protection Board in the event of No Deal:
- Confirm the validity of current Standard Contractual Clauses to provide clarity and confidence to businesses that if they use SCCs to transfer personal data from the EU to the UK they will be compliant
- Consider encouraging Data Protection Authorities in the EU to implement regulatory forbearance periods to provide EU companies with more time to prepare alternative mechanisms to transfer data and provide more time for the UK and EU to agree adequacy.
Commenting on the launch of the joint paper, Antony Walker, techUK Deputy CEO said:
“The UK and Poland are important and close partners. The ability to transfer personal data between both countries is vital for individual citizens and businesses alike. Whether it is the UK being Poland’s third largest purchaser of services, Polish citizens being the largest group of EU citizens in the UK or the increasing digitisation of the Polish automotive industry, the ability to transfer personal data between the UK and Poland is essential.
“While it remains unclear what direction the UK’s future relationship with the EU will take, it is clear that whatever the outcome is, we must avoid a cliff-edge for data transfers between the UK and Poland. A UK-EU adequacy agreement is by far the best solution to this, however in the event such an arrangement cannot be reached by the time the UK leaves the EU, techUK urges the UK and Polish Governments and regulators to explore other possible short-term solutions, including possible nonenforcement periods.”
Additionally, Michal Kanownik, President of ZIPSEE Digital Poland said:
“This could be a real issue for further cooperation of British and Polish advanced technologies industry as well as for the other members of the EU.“Many of those enterprises have long standing business practices relying on such data transfers. A change in the UK’s legal relationship with EEA data protection rules is likely to cause significant uncertainty and additional costs for all businesses who hold personal data.
“Continued stability of data flows is in the mutual interest of both the UK and the EU. This is true for all sectors of the economy that rely on data flows on a daily basis. A close relationship would also provide confidence to consumers across Europe that their personal information will continue to be subject to strong data protection rules, with access to redress if necessary.”
The joint techUK and ZIPSEE paper is available to be downloaded, in both English and Polish, below. If you would like to discuss these issues in greater detail, please do not hesitate to get in touch.