The European Commission on Monday sealed a data flows deal with the United Kingdom worth billions of euros in digital trade.
The approval by the EU’s executive comes only days before an interim solution to keep data flowing across the Channel after Brexit runs out.
The adequacy decision, as the data flows deal is known, will allow personal data to be transferred from the EU to the U.K., avoiding a no-deal scenario that could have cost the British economy as much as £1.6 billion.
U.K. Secretary of State for Digital Oliver Dowden said: “After more than a year of constructive talks it is right the European Union has formally recognised the UK’s high data protection standards. This will be welcome news to businesses, support continued cooperation between the UK and the EU and help law enforcement authorities keep people safe.“
In a first, the EU’s decision requires both sides to renegotiate the deal in four years‘ time. That means the EU could pull the deal if the U.K. diverges too far from the EU’s privacy rules. That could have a big impact on the U.K., since three-quarters of its international data flows are with the 27-country bloc. London has said that it wants to revamp its privacy standards in a bid to reap greater economic rewards from data.
“After months of careful assessments, today we can give EU citizens certainty that their personal data will be protected when it is transferred to the U.K. This is an essential component of our new relationship with the U.K. It is important for smooth trade and the effective fight against crime,“ EU justice chief Didier Reynders said in a statement.
Despite the announcement, the decision has faced heavy criticism from European lawmakers, regulators and privacy activists, who argue that the U.K.’s surveillance rules and exemptions for immigrants merited further scrutiny from Brussels. Responding to concerns, Commission Vice President Věra Jourová said Brussels had baked in safeguards that allow it to intervene if Britain diverges too far from EU data protection standards.
The approval on Monday caps off a fraught process. The European Commission ran out of time to approve the deal before the Brexit transition period ended in January 2021, so had to work a temporary, six-month solution into the trade deal to keep continue transferring data.
Since then, the EU’s decision to approve the U.K.’s data regime, first proposed in February 2021, was heavily criticized by Europe’s network of privacy regulators, the EDPB, as well as MEPs — who as late as Friday were urging the Berlaymont to postpone its approval of U.K. data standards.
Their criticism is based on the British government’s plan to diverge from EU data protection standards — which is a prerequisite to getting the deal — as well as court rulings in Europe and London that have cast doubt on the legality of Britain’s privacy standards, and the country’s surveillance regime.
U.K. adequacy is likely to come under intense scrutiny in the coming months and years, with several campaigners preparing legal cases against the decision, inspired by successful challenges against similar data flows deals with the United States.
Annabelle Dickson contributed reporting.
Want more analysis from POLITICO? POLITICO Pro is our premium intelligence service for professionals. From financial services to trade, technology, cybersecurity and more, Pro delivers real time intelligence, deep insight and breaking scoops you need to keep one step ahead. Email [email protected] to request a complimentary trial.