PARLIAMENTARY DEBATE
Exchanging Data with non-EU Countries - 23 October 2018 (Commons/General Committees)

It is a pleasure to serve under your chairmanship, Mr Evans. I declare my interest, which is in the Register of Members’ Financial Interests. I am a member of the European Scrutiny Committee and of the Select Committee on Science and Technology, which both have an interest in this area. I apologise on behalf of my many colleagues who were not able to join us today.

The exchange of personal data between the UK and the EU is vital for current business, the functioning of public services, security and policing, and future trade. Whether it is used by innovative, cutting-edge new businesses or modernising old industries, data is at the heart of revolutionising the way we work and the way we live our daily lives. Data is becoming so pervasive that this issue affects both our constituents and the organisations we often refer to in such debates. The General Data Protection Regulation has brought data protection to the minds of many people who may not previously have spent much time thinking about it, and data breaches by big-name companies, digital or otherwise, keep the issue in the headlines. That is why we are having this important debate.

Although the European Scrutiny Committee thanks the Government for agreeing to schedule the debate, we are disappointed that it is not on the Floor of the House as we requested, particularly as a wide range of Select Committee Members, who unfortunately could not be here, have an interest in the topic. I hope the debate sheds light on the Government’s position on personal data flows in three different Brexit scenarios and in the post-Brexit world—if, as I keep saying, Brexit actually happens.

First, how will personal data transferred from the EU to the UK during a transition period be treated after that period? I understand that is one of the so-called separation issues to be dealt with under the withdrawal agreement—specifically article 67 of that agreement, which states that personal data needs to be processed in accordance with European Union law during any transition period, and thereafter in respect of what happens in the agreement. Will the Minister for Digital and the Creative Industries update us on the negotiations with the European Union about how safeguards will be put in place during a transition period and, in respect of data flows within such a period, under a new regime when it comes to an end? We were reassured by the Brexit Secretary both on the Floor of the House and in the Select Committee that there has been real progress in that area, so a general update would be welcome.

Secondly, what happens if a withdrawal agreement is not ratified before the UK’s exit on 29 March 2019? The Government recognise in their no deal guidance that there is not yet an agreed timetable for putting an adequacy decision in place in the event of no deal. Leaving with no deal would mean leaving with no data-sharing agreement. Without an adequacy decision, data could continue to be transferred only on the basis of alternative safeguards set out under GDPR—namely, standard contractual clauses for businesses and organisations. Will the Minister therefore set out what assessment her Department has made of the feasibility and cost to business of having to comply with such alternative safeguards in the case of a no deal Brexit? What is her view of the pending European Court of Justice case on the validity of standard contractual clauses, Data Protection Commissioner v. Facebook Ireland Ltd and others—the Schrems II case—in respect of the Government’s no deal advice?

Thirdly, for the post-Brexit world, the Government have repeatedly said on the Floor of the House that they seek to achieve a data-sharing agreement that goes beyond adequacy. There was some debate about whether that might be the basis of an agreement between the UK and the EU or reliant on the adequacy decision, which is of course unilaterally made by the European Commission. While we have debated that on a few occasions, I am still not clear about the Government’s preferred method, although I note that in the motion the adequacy unilateral decision is the “starting point”. Will the Minister set out today whether any enhanced arrangement beyond adequacy is realistic given the state of the Brexit negotiations, and what the position is on the UK’s proposal for a beyond adequacy agreement? Will she comment on the Government’s response to the Exiting the European Union Committee’s report on data, which suggests that enhanced adequacy involves some form of participation of the UK in EU data bodies and/or in a one-stop shop, which would involve an agreement to allow the relevant European Court jurisdiction and/or jurisprudence?

Finally, on future trade, does the Minister for Trade Policy envisage future trade deals including constituent or adjacent horizontal clauses on data sharing, to align with European standards in third-country trade deals? Will he confirm whether the clauses try simply to tackle data-sharing non-tariff barriers, or if they are envisaged to have an additional effect that could assist the UK in maintaining data-sharing safeguards with the European Union? Lastly, if possible, will he update the Committee as to the status of any proposed EU-UK agreement at treaty level, and what if any lessons have been learned from, for example, the EU-Japan free trade agreement?

I add on behalf of the European Scrutiny Committee that we still await a response to the questions posed on this topic in our report of 12 September. I am sure that the Ministers will take the opportunity today to answer any more general questions but, if not, I look forward to a commitment that we will receive that response in due course.

I thank the hon. Member for Bristol North West for running through the European Scrutiny Committee’s proposals for this afternoon’s debate. My colleague the Minister for Trade Policy and I welcome the opportunity to debate this important subject. The cross-cutting nature of data in trade agreements and its significance for our Departments mean that we will both make an opening statement and participate in the question-and-answer session. We have agreed to be brief and to stay within the conventional 10 minutes.

The free flow of data, with citizens who are rightly confident that their data, particularly their personal data, will be protected, is integral to our economy and vital for law enforcement co-operation before, during and post Brexit. The amount of data that we generate as citizens and businesses is increasing rapidly. Data flows help to ensure not only that people get paid and that health services can co-operate, but that people can live their lives. They affect all consumers and businesses. As we leave the EU, the UK will continue to be at the forefront of driving up standards and protecting individual citizens’ privacy, while ensuring that data continues to grow and be processed legally.

Many of the issues that we will touch on came up during the passage of our Data Protection Act 2018, and we welcomed the debates in the House on citizens’ privacy rights. I am proud of the Act, of our world-class regulator and that the UK has high standards of data protection, in line with the GDPR and the law enforcement directive. The Government have solidified the UK’s presence as a global leader in data protection. As such, we laid the foundations to forge trade agreements and take up a leadership role in promoting the free flow of data with high data protection standards. We believe that the provisions of trade agreements on the free flow of data and robust data protection frameworks are not in conflict. In fact, they should be mutually reinforcing. The Government have worked with the European Commission and member states to push for ambitious data clauses in trade deals to reduce protectionist barriers. We continue to engage with the Commission on their proposals.

The Government are looking forward to striking trade deals with provisions that lower barriers to cross-border data flow and, in particular, to deal with data localisation requirements, which can act as a protectionist force, locking companies out of overseas markets. We want to see data flow freely across national boundaries to allow enterprise, new ideas and economies to flourish within the close confines of data protection. That approach will align us with the growing digital economy in the European Union while opening up new opportunities in other fast-growing regions of the world.

I look forward to our debate. Negotiations with the European Union are live, so my hon. Friend the Minister for Trade Policy and I are somewhat constrained in what we can say, but I hope we can give the Committee enough detail during questions as we set out with clarity the advantages of our data and trade policy.

The free flow of data, including personal data, is crucial to international co-operation and trade in the modern world, but it must be underpinned by high data protection standards. Because so much digital data involved in business and trade today includes at least some personal data, it is vital that the UK pursues trade rules in this area that provide clarity and certainty to industry and individuals so that personal data may continue to flow securely and freely while remaining protected.

I want to emphasise how the Government are committed to facilitating data flows as a key driver of global trade and the lifeblood of today’s digitalised economies while ensuring that rights to data protection and privacy are safeguarded. Data flows are vital not only to high-tech industries but to traditional sectors, goods and services. A trade framework for the UK and its international trading partners that includes robust commitments enabling cross-border data transfers and prohibiting data localisation is therefore critical for the UK’s future prosperity and economic growth. Even with the vast and numerous benefits to companies, consumers and economies that arise from the ability of organisations to share data easily across borders, dozens of countries are erecting unjustified barriers to cross-border data flows, such as data localisation requirements that seek to confine data within borders. Such a strategy can have a detrimental effect on the free flow of data. Trade agreements that include substantive provisions designed to enable data flow do not undermine data protection or privacy; on the contrary, such provisions tend to reinforce and safeguard protections for personal data and privacy.

Trade provisions often make clear that they do not prevent data from being subjected to data protection regimes and are therefore complementary to data protection and privacy. Countries should therefore be able to apply legitimate measures to protect data travelling to third countries. However, such international transfer regimes can facilitate or hinder the ability of countries to take advantage of trade measures on the grounds of privacy and the right to data protection.

After a period of some years and intense internal debate, we welcome the European Commission’s initiative in tabling proposals on cross-border data flows in trade agreements. That has been a sticking point in the Commission and the EU for a number of years. In particular, we welcome provisions designed to tackle unjustified data localisation requirements, which often serve to reduce trade with and new investment in trading partners, thereby depressing economic development. Although the UK Government see the provisions as a good starting point, we will look to be a world leader in setting clear and ambitious provisions in future trade agreements in this area as well as to shape the new global standards for modern free trade agreements.

Finally, I will have a crack at answering some of the questions from the hon. Member for Bristol North West. We very much welcome the EU’s position, as it has crystallised some of its thoughts and published a substantive text for the first time for use within the EU-Indonesia free trade agreement. We are looking for ambitious provisions to facilitate data flow and ensure that the playing field is level in areas such as data localisation. Any agreement will have to ensure that the high levels of personal data protection are not put at risk. As I am sure the hon. Gentleman knows well, the GDPR will be directly applicable in UK law straight after Brexit; it will be adopted as our standard. Trade provisions will therefore not form a legal basis for transfers of personal data. In short, we will lay the pipework and allow the playing field to be laid so that data can flow fairly across borders, but it is for others—the Department for Digital, Culture, Media and Sport, other authorities and other third-party countries—to turn the taps on or off.

May I preface a couple of questions with some initial thoughts, Mr Evans? I congratulate my hon. Friend the Member for Bristol North West on bringing this matter to the Committee.

Of course; I appreciate that, Mr Evans.

Like me, my hon. Friend will have been alarmed by the catena of platitudes from both Ministers this afternoon about the importance of data, the importance of trade and the importance of data to trade. We heard absolutely nothing about whether the Ministers are confident of securing an adequacy agreement, especially in the event of a no deal Brexit. As is eloquently set out in the paperwork for today’s hearing, the Ministers know as well as we do that this has to be signed off not only by the European Commission, but by the European Parliament, the article 29 working group and the European data protection supervisor.

Given the imminence of Brexit, I am extremely concerned that we have heard nothing about a timetable or a level of confidence. My question is blunt: in the event of a no deal Brexit, are the Ministers prepared to guarantee to the House this afternoon that a data adequacy agreement will be secured and that free data flows will continue?

I thank the right hon. Gentleman for his question. I cannot give him a categorical assurance that an adequacy agreement will be in place at any particular point during the negotiations. I can tell him that the UK Government have made it clear to the Commission that we are ready to commence discussions on a future adequacy agreement, even though the Commission has not indicated that it is yet ready to start such discussions. If we are successful in securing the transition and implementation period, we will stand ready to begin those preliminary discussions on an adequacy assessment during that period. Indeed, we stand ready now, but the Commission has indicated that it is not yet ready.

We agree that our primary goal is to secure an adequacy agreement. Through the recent publication of a technical notice, we have various provisions in place that should allow for the free transfer of data during the period in which we are discussing adequacy but have not yet secured it.

I do not know whether you prefer me to ask these questions standing up or sitting down, Mr Evans.

Thank you, Mr Evans. I am grateful for the Minister’s answer, but perhaps she could go further and tell us the precise timetable her officials have given her for what needs to be agreed when. Ultimately, we need to know when an adequacy agreement needs to be in place to ensure the free flow of data after we have left the European Union, which the Prime Minister assures us will happen at the end of March. Given that long stop date, as it were, what is the timetable for securing the necessary agreements from the European Parliament, the article 29 working party and the European data protection supervisor?

As I said, the UK is ready to begin preliminary discussions on an adequacy assessment now. I cannot give a cast-iron timetable, because I cannot speak for the European Commission, which is the vital party to such discussions. The ball is in its court. We have indicated that we are ready and willing to start adequacy discussions. We anticipate that those discussions will take place during the transition and implementation period. Through the technical notice, we have established the arrangements that we would put in place if there were to be a gap between our departure from the European Union and the timing of the future framework. We all know what is going on—on both sides—on many fronts, not just data protection.

My last question is to press the Minister on a single point: by what date must an adequacy agreement be reached and in place to ensure that the free flow of data continues?

The Government will ensure the free flow of data, even if there is a gap between the time at which the United Kingdom obtains an adequacy decision and the time at which we leave the European Union. We are scheduled to leave the European Union at the end of March next year. We anticipate that there will be an implementation period that takes us a further 20 months. During that implementation period, we anticipate discussions with the Commission on an adequacy decision.

We cannot guarantee exactly when that adequacy decision will be made. I reassure all members of the Committee that on our departure from the European Union we will be 100% aligned with European data protection law, particularly the provisions of the GDPR. The right hon. Member for Birmingham, Hodge Hill and I shared many discussions during proceedings on the Bill. When it received Royal Assent in May this year, it put us in 100% alignment with EU data protection law. We can be optimistic that an adequacy decision will not require the usual length of time that it takes the Commission to bestow such decisions on other third countries. However, the right hon. Gentleman will understand that I cannot give a guarantee on that, because to do so is not in the UK Government’s gift. The decision will be forthcoming from the European Union.

If the right hon. Gentleman wants me to tell members of the Committee what will happen if we do not have an adequacy decision, either as we leave the European Union next March or even after the implementation period, I am happy to do so, but he looks as though he wants to intervene.

I am much less sanguine than the Minister about the possibility of an adequacy agreement. As she knows, we will not have article 8 to rest on after we leave the European Union. We have also sketched into the Data Protection Act 2018 sweeping exemptions from the GDPR for anyone who happens to be an immigrant, so I think the European Parliament will have some serious questions for the Minister about the adequacy agreement. Do we need an adequacy agreement in place to cover the implementation period, or not?

I am not sanguine about anything to do with this; it is a serious matter. I may be optimistic, but there is a lot of work to be done, and I cannot guarantee when an adequacy decision will be made. I can only state categorically that it is the Government’s intention to prioritise discussions in relation to adequacy with the European Union, such that we get an adequacy decision as soon as it is practically possible for the European Commission to grant us one.

We have put in place some exemptions to the GDPR, as have other member states, but we have done so in a framework that permits member states to apply such derogations and exemptions. Other member states will have put in place similar or different exemptions. I contest the right hon. Gentleman’s statement that the exemptions are “sweeping” in respect of immigration. I remember the debates well. The powers are extremely contained, and they were amended on Report to constrain them even further.

I can answer questions about the measures that we will put in place if there is a gap between the granting of an adequacy decision and our departure from the European Union—and, indeed, after the implementation period, assuming the implementation period is agreed.

Motion made, and Question proposed,

That the Committee takes note of European Union Document No. 5191/17, a Communication from the Commission to the European Parliament and Council on Exchanging and Protecting Data in a Globalised World, and an Unnumbered European Union proposal for provisions on Cross-border data flows and protection of personal data and privacy; welcomes the adequacy framework as an effective means of ensuring a free flow of data from the EU to third countries; and further notes that in the context of the UK leaving the EU it provides the right starting point.—(Margot James.)

I have made my opening statement and I have answered questions. I have indicated my willingness to answer further questions, should they arise during the debate, but I have nothing further to say at this stage.

I am slightly alarmed by the content of this afternoon’s debate. Perhaps it might be easier for everyone if I tabled several parliamentary questions to follow up on the debate.

I am not clear whether adequacy discussions have begun in detail; I am not clear whether an adequacy agreement is needed for the implementation period; and I am not sure about the Minister’s level of confidence that an adequacy agreement will crystallise and be in place by the time the implementation period finishes. I have heard nothing about the Government’s assessment of the attitude in the European Parliament and the other organisations that have to sign off the decision. I am afraid that today’s debate has opened rather more questions than it has closed.

Question put and agreed to.