How the GDPR is going to survive in the UK post Brexit?

On 15 May 2020, Michel Barnier, the Head of the EU Task Force for Relations with the United Kingdom, provided his view following Round 3 of negotiations for a new partnership between the European Union and the United Kingdom. He clearly expressed disappointment at the outcome thereof.

In particular, as regards police and judicial cooperation in criminal matters, Barnier underlines that the UK "insists on lowering current standards and deviating from agreed mechanisms of data protection – to the point that it is even asking the Union to ignore its own law and the jurisprudence of the European Court of Justice on passenger data (“PNR rules”)", before adding : "that is of course impossible."

It is clear from these strong statements that we are in the middle of tough negotiations with political posturing on both sides. At this stage, it is not surprising that both camps are showing their muscles.

The key is what the UK and the EU are willing to achieve together.  If they are willing to achieve a deal with a balanced agreement and a long-term relationship going forward, data protection will have to be embarked in that deal as it is a fundamental right in the EU. If no agreement can be reached and we end up with a hard Brexit, the UK will be free to adapt their approach towards privacy. This does not mean that they will repeal the GDPR requirements as this text has also been adopted by their representatives and it embodies fundamental protection for UK citizens too. They may however consider some divergences compared with the EU approach.

For businesses, the best scenario would be that an agreement is reached with a high degree of similarity across the Channel. This could lead to a recognition of adequacy which would mean that the UK would be assimilated to an EU Member State from a data transfer viewpoint, just like Switzerland and a few others.

Such an adequacy will be subject to a careful assessment of the UK’s data protection framework (whether or not it diverges from the GDPR), including the approach towards surveillance by public authorities.

Let's hope a political compromise can be reached as data exchanges are more crucial than ever in today's digitalised world.