The new US Executive Order for transatlantic data flows: where does that leave the UK?
Businesses were pleased today by President Biden’s Executive Order proposing new commitments for EU-US data flows. While encouraging for future cross-Atlantic digital trade, decision-makers must prioritise turning this long-awaited deal into a reality.
The Order addresses the legal concerns raised in the Court of Justice of the European Union (CJEU) decision in July 2020 which invalidated the data adequacy agreement (known as Privacy Shield) relied on by many organisations transferring personal data between the EU and US.
This includes new safeguards for US Intelligence Services' access and use of personal data, redress mechanisms for individuals in such circumstances, as well as processes to review the Intelligence Community's compliance with the new requirements.
Although this marks a significant step in reaching a new data transfers agreement, there is still a lengthy process ahead for the proposal to be ratified by the European Commission, which could take anywhere as up to six months to complete. The new agreement will also have to stand the test of scrutiny from privacy and civil liberties groups which could trigger a new legal review by the CJEU.
A fragmented landscape
Since the invalidation of the Privacy Shield, businesses have operated under a period of persistent uncertainty while trying to transfer personal data between the EU and US. Alternative transfer mechanisms such as standard contractual clauses (SCCs) have proven unreliable and inaccessible for organisations of all sizes.
This has a direct impact on businesses seeking to innovate, enter new markets, offer new products to consumers, or deliver basic businesses services. By the US Chamber of Commerce’s own estimation, the data transfer relationship between the US and EU is worth around $7.1 trillion. In fact, global data flows now contribute more to global growth than global trade in goods.
While this agreement provides firm reassurance to the hundreds of businesses relying on EU-US data flows, it is long-awaited and has ultimately come at a cost to consumers and businesses trying to innovate. It has also led to delays in the UK’s own plans to reach a data adequacy agreement with the US.
The national security tensions underpinning EU-US data transfers sits at the centre of growing complexities on how personal data can flow across borders. As we see increasing fragmentation between countries and their approaches to data protection, businesses are forced to navigate complicated and often overlapping legal requirements.
This opens up questions as to whether new frameworks are needed to resolve these tensions and what role the UK could play in shaping these solutions.
Where does that leave the UK?
Separately, following a visit by US Secretary of Commerce, Gina M. Raimondo to the UK, a joint statement was published today, launching a UK-US Comprehensive Dialogue on Technology and Data.
Issued with the UK Secretary of State for Digital, Culture, Media and Sport, The Rt Hon Michelle Donelan MP, the announcement builds on a 2021 commitment to develop a bilateral Technology Partnership.
The Comprehensive Dialogue on Technology and Data includes three work strands to be focussed on in the coming year: Data; Critical and Emerging Technologies; and Secure and Resilient Digital Infrastructure, agreeing and delivering initiatives that support tangible and impactful outcomes.
Against this development, the UK Government also welcomed the signing of today's US Executive Order, committing to a speedy assessment in order to secure an adequacy decison for UK-US data sharing. The UK Government also highlighted its ambition to continue a strong bilateral relationship with the US on data transfer challenges by enaging in multilateral initiatives such as the Global Cross-Border Privacy Rules Forum and the OECD's work on Trusted Government Access to Data.
Julian David, CEO of techUK said on this announcement, "Today's progress on UK-US data sharing will be welcomed by businesses across the UK. An agreement will provide business with the legal certainty and confidence needed to access new markets and create opportunities for innovation. This will enable the UK to leverage its world-leading industries such as financial services and tech to drive wider economic growth on all sides of the Atlantic.”
Julian David, CEO of techUK, said on the signing of the Executive Order:
Julian David
Julian David is the CEO of techUK, the leading technology trade association that aims to realise the positive outcomes that digital technology can achieve for people, society, the economy and the planet.
Dani Dhiman
Dani is Policy Manager for Artificial Intelligence & Digital Regulation at techUK, and previously worked on files related to data and privacy. She formerly worked in Vodafone Group's Public Policy & Public Affairs team supporting the organisation’s response to the EU Recovery & Resilience facility, covering the allocation of funds and connectivity policy reforms. Dani has also previously worked as a researcher for Digital Catapult, looking at the AR/VR and creative industry.
Sabina Ciofu
Sabina Ciofu is Associate Director – International, running the International Policy and Trade Programme at techUK.
Neil Ross
As Associate Director for Policy Neil leads on techUK's public policy work in the UK. In this role he regularly engages with UK and Devolved Government Ministers, senior civil servants and members of the UK’s Parliaments aiming to make the UK the best place to start, scale and develop a tech business.
Sue Daley
Sue leads techUK's Technology and Innovation work.