On 14th November 2018, the EU and British Government published a draft of a withdrawal agreement to deal with the UK’s departure from the EU.
The Agreement has since been endorsed by the governments of the EU member states. It awaits a vote of the UK Parliament.
It proposes the UK departure from the EU in March 2019, with a ‘transition period’ ending (initially) on the 31st December 2020. After that point the UK is bound to follow EU rules if it wishes to continue access to the EU market (or, alternatively, to accept goods checks etc between Northern Ireland and the rest of the UK).
What does the agreement say about data?
For data protection purposes, the articles of primary interest in the Draft Withdrawal Agreement are Articles 127-129, dealing with the application of EU law during the Transition Period and Articles 70-73. These latter provisions deal with “Data and Information processed or obtained before the end of the transition period or on the basis of this agreement”.
Article 71.1 confirms that EU law is applicable, directly in the UK, to data transfers made to countries outside the UK.
Article 71.2 says that EU law shall not directly apply in the UK to data processed under an adequacy decision.
Article 71.3 says that if there’s no adequacy agreement the UK is bound to the requirement to provide the equivalent level of protection to data subjects as required under EU law.
Article 72 says that EU data law will apply to the organs of the UK state.
Article 73 says that UK data which is transferred to the EU shall be treated as though it were the data of a Member State. It does not say that the converse is also true.
Applying Union Law not the same as being a Union Member
This has been read- insofar as any public attention has been paid to the issue- as meaning that the UK may carry on as before during the transition period, treated as if it were a member state for the purposes of data transfers.
But, clearly, this not what is stated in Articles 70-73, on data processing.
A basis could be found grounded in an optimistic reading of Articles 127.1 and 127.3, read together.
Unless otherwise provided in this Agreement, Union law shall be applicable to and in the United Kingdom during the transition period.
During the transition period, the Union law applicable pursuant to paragraph 1 shall produce in respect of and in the United Kingdom the same legal effects as those which it produces within the Union and its Member States, and shall be interpreted and applied in accordance with the same methods and general principles as those applicable within the Union.
The problem for proponants of a cheery reading of these sections is that Union law is clear about one thing- that transferring personal data to a non-Member state requires a legal basis.
Article 73 says that UK data which is transferred to the EU shall be treated as though it were the data of a Member State.
It carefully does not say that EU data transferred to the UK shall be considered to be travelling to a Member State. It cannot, because the EU negotiations can’t agree something that would be illegal under EU law.
European Union law is agreed to have the same ‘legal effects’ as those which it produces in the Union and its Member states, under Article 127.3. But, within the Union and its Member states, the effects of a personal data transfer under Union law depend on whether the destination country is a Member state, or whether it is not.
After March 2019, the UK will not be a Member state. And the agreement to apply Union law will have the legal effects which flow from that fact. Given the current uncertainty, it would be wise for companies to arrange for alternative legal grounds (Standard contract clauses etc) for data transfers to the UK to be in place by March 2019.