I have come to the conclusion that the Government does not care whether or not the UK’s Adequacy Agreement with the European Commission continues after its expiry (latest in mid-2025).
This conclusion is based on the well-publicised deficiencies in the two consultation exercises of the DCMS (on data protection) and MoJ (on human rights) and the recent report of Joint Parliamentary Committee on Human Rights into the MoJ proposals. This latter Report carries many warnings concerning the Government’s intent to diminish individuals’ rights (see references).
This blog explains how I have arrived at my two fingered conclusion. It is not a deep analysis full of minutiae; the text is more a reflection on the current nature of the UK Government.
The UK’s Adequacy Agreement
In theory, Article 3(4) of the UK’s Adequacy Agreement allows for termination by the European Commission at any time. However, there can be a long convoluted consultation process and I suspect that if the UK made significant changes to its data protection and human rights regime (as proposed), then the Commission will want to assess the impact of these changes on the rights and freedoms of European data subjects.
Such an assessment will take time (e.g. up to mid 2025). However, a shorter timescale is more likely to be followed if the UK Government determines its post-Brexit trading partners (e.g. India; Australia) are adequate when the European Commission has made no such determination. This shortening arises from the risks to European data subjects from onward transfers of personal data, from the UK, to these Third Countries.
Equally, the timescales could shorten if there are changes to the UK Human Rights regime as proposed by the MoJ (as these are more drastic than the DCMS proposals for change).
Important observations
There are four considerations:
- It is the European Commission that really decides on the status of its Adequacy Agreements with Third Countries; Countries like the UK do not apply for adequacy – it is more or less in the gift of the Commission (after a convoluted process). This could explain why the DCMS and MoJ Consultations do not mention the UK’s Adequacy Agreement in their respective consultations as there is nothing the UK could do if the Commission rescinded the UK’s Agreement tomorrow.
- The Adequacy Agreement with the UK contains expectations that the UK’s data protection and human rights regimes have specific characteristics; if the UK no longer wants to attain these expected standards, it is the European Commission that has to decide what to do. Its choices are essentially limited to three options: (a) maintain, (b) modify, or (c) rescind the current Agreement with the UK.
- The Government is arguably calling the Commission’s bluff. In effect it is saying: “the UK is going to change its privacy regime; if you Europeans don’t like what we are doing, then you can rescind the UK’s Adequacy Agreement if you want, but that might hurt trade and general co-operation with the UK on matters of mutual interest”.
- The Commission when making any assessment of the Adequacy Agreement will be looking at the protection of European data subjects, under the UK’s new DP/Human Rights regime, when their personal data is processed in the UK. It will NOT be looking at the protection afforded to UK data subjects; these rights and freedoms can be safely degraded, without any risk to Adequacy (e.g. in the way the DCMS and MoJ consultations propose).
Proposals for change: absence of evidence
The DCMS proposals for change in the UK’s data protection regime have been discussed in detail in previous blogs (see references); these proposals are characterised by omission (e.g. from Rosemary Jay), incomplete detail (e.g. from the ICO) and a lack of evidence for the proposed changes (e.g. from the DCMS consultation document itself). As I have stated before, I am not the only person who is “harping on” about these failings.
Similarly, the DCMS and MoJ consultations ignored the link between data protection and Article 8 of the European Convention on Human Rights. For what it is worth, the MoJ proposals have just been heavily criticised by the Joint Parliamentary Committee on Human Rights (JPCHR); it concluded that, contrary to the assertions of the MoJ, its proposals would “weaken human rights” and that there was “no real case for changing the HRA …” (see references; paras 25&26 of the JPCHR report).
As an aside, I reported in the blog on the MoJ’s misrepresentation of ML v Slovakia and Ellis v Essex Police judgements in its consultation document. The JPCHR Report similarly (politely) trashes most of the cases quoted by the MoJ; this is something I find shocking, especially as MoJ arguments for change depend on its view of these cases.
With respect to all qualified rights (e.g. A.8), the JPCHR have a stark warning which should be heeded by all:
“Giving undue priority to freedom of expression in primary legislation could undermine the ability of individuals to enforce their rights to privacy, a fair trial and freedom of assembly and upset the balancing exercise the courts currently undertake when competing rights are engaged” (para 210).
and
“The Government’s proposals …would limit the ability of individuals seeking to enforce their rights, for example, to private and family life…” (para 212).
Despite the lack of evidence, the Government published a Brexit Paper associated with the ‘Brexit Freedoms’ Bill” which promised legislation to enact major reform to the UK’s data protection regime. This was followed by the Secretary of State for Brexit Opportunities, Jacob Rees Mogg, in the Sun Newspaper (9 Feb 2022); he wrote that “….there will be a new approach to data, removing the EU’s cumber-some one-size-fits-all policy..”
Note that these statements promising legislation were made well in advance of the outcome or analysis of the DCMS or MoJ public consultations.
This explains why I think the consultations are largely irrelevant and the changes to the human rights and data protection proposals are being promoted as matters of political dogma. Both the DCMS and MoJ “consultations” have been exposed as failed attempts to give its proposals a veneer of rationality and respectability.
Refreshing “Operation Save Big Dog”
This dogmatic approach to individual rights has coincided with Operation Save Big Dog (the name given last January to the effort expended to ensure the Prime Minister survived the fallout from several, alcohol-fuelled, “office-gatherings” at 10 Downing Street).
Over time, Saving Big Dog has taken the form of a wall-to-wall publicity concerning the actions of Big Dog himself: headlines and photo ops covering the Ukrainian war; the fuel and cost of living crisis; ending COVID restrictions; parking lorries on the M20 because there is no space in Dover; and the decision to send asylum seekers to Rwanda etc.
Such activity “justifies” the argument that because we are so dependent on the current (highly active) Big Dog making important decisions for all of us; appointing another Big Dog to make such decisions, just because of “a little local difficulty” over a few lockdown parties, is a distraction that the country can ill-afford.
Concluding comment
However, nothing has happened to remind the British public of the brilliance of the UK’s “oven ready” Brexit deal as implemented by our trustworthy Prime Minister. For instance, there has been very little of the promise to “take back control of our laws”.
But by pure happenstance, two committed Brexit Ministers (Nadine Dorries, Dominic Raab), who owe their political careers to the Prime Minister, happen to be in charge of the DCMS and MoJ. They are responsible for their Departments’ defective consultation exercises and it is well known that a lack of evidence does not give such Ministers sleepless nights.
What better opportunity for symbolic action than to throw some red-meat to ardent Brexiters to indicate that the UK has taken back control of its data protection and human rights laws: “Let us show those Europeans how the UK protects its own citizens, and if that means waiving two fingers at that Adequacy Agreement, then so be it”.
Forget the paucity of evidence, the lack of detail, all the omissions and the erroneous analysis; these are unimportant.
And if need be, the Ministers can blame those Europeans for rescinding the UK’s Adequacy Agreement (just as the UK is doing with the fishing paperwork fiasco, lorry queues at Dover and the Northern Ireland protocol).
Summer Data Protection Courses
Because of continued COVID uncertainty, the following courses can be attended in person, or via Zoom, or as a mixture if you something untoward happens. It's up to you.
- The next two Data Protection Practitioner Courses are in One starts Monday, May 16 (5 days) and the other on Tuesday July 5-7; July 19-21 (6 days); full details on www.amberhawk.com/StandardDP.asp or by emailing [email protected]
- The next Data Protection Foundation Course is in London, and starts Tuesday, July 12-14 (3 days); full details on http://www.amberhawk.com/DPFoundation.asp or by emailing [email protected]
References
The Joint Committee of Human Rights Report into the MoJ proposals (a must read): download available from https://committees.parliament.uk/work/6404/human-rights-act-reform/publications/
The Adequacy Agreement with the UK: https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_en.pdf.
The Benefits of Brexit: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1052148/benefits-of-brexit-document.pdf
Rosemary Jay’s Independent evidence that the DCMS data proposals could undermine adequacy (and the like the ICO, where the DCMS Consultation is unclear or wrong-headed) https://amberhawk.typepad.com/amberhawk/2022/01/independent-evidence-that-the-dcms-data-proposals-could-undermine-adequacy.html
My response to the DCMS Consultation (with links to my 7 blogs on different parts of the DCMS Consultation at the end of this link): https://amberhawk.typepad.com/amberhawk/2021/11/data-a-new-direction-amberhawks-response-to-the-dcms-consultation.html
The link to four blogs and details of the MoJ human rights Consultation (see end of): https://amberhawk.typepad.com/amberhawk/2022/03/omissions-in-human-rights-proposals-degrade-privacy-and-freedom-of-expression.html
Very right, Chris! And that is without mentioning the UK’s surveillance laws and activities …
Posted by: Douwe Korff | 28/04/2022 at 09:31 PM