Today the Department for Digital, Culture, Media & Sport (DCMS) issued a three-part announcement on (i) the process for UK adequacy and the countries identified as priorities, (ii) the new ICO appointment and (iii) some high level comments on rejigging the UK’s data laws.

The process for UK adequacy 

The DCMS has launched its package of measures designed to “develop global partnerships which will make it easier for UK organisations to exchange data with important markets and fast-growing economies”. These measures are part of a programme designed to capitalise on the lucrative digital data economy.

Post-Brexit, the aim of these proposed new data adequacy partnerships is to open up global markets to UK businesses by reducing the “unnecessary barriers and burdens on international data transfers”. This language is unlikely to go down well in Brussels where the ink is barely dry on the EU decision to grant the UK adequacy. Perhaps conscious of this, there are references throughout the announcement and various accompanying documents for the need for those countries identified to have “high data protection standards” when assessing whether or not to enter into a data adequacy partnership. The Government has published its UK manual and guidance for undertaking adequacy assessments to aid transparency as well as demonstrating the commitment to these high data protection standards.

The UK data partnership map sets out the 42 countries currently recognised by the UK as being adequate, (but let’s not forget to include the EU Institutions themselves, while not a country they are deemed adequate for the purposes of the UK GDPR), as well as the 6 “top priority countries”, namely:

  • Australia;
  • Columbia;
  • Dubai International Finance Centre;
  • The Republic of Korea
  • Singapore; and
  • The United States of America.

Four further countries are identified as “longer term priorities”, namely: India; Brazil; Indonesia and Kenya. There are no prizes for guessing which country will cause the most ruffled feathers on the Continent. While the EU continues to negotiate with the USA post-Schrems II, looking for consensus on a replacement for the Privacy Shield, the UK is forging ahead on its own data adequacy partnership with the USA. This is not a surprise, especially when “92% of the UK’s service exports to the US are data-enabled, amounting to £67.03billion”. While the ‘special relationship’ may be under strain for other obvious reasons, it appears to be very much evident in the realm of economics.

While there is a lot of focus on the business benefits to the UK’s approach there seems to be little in the way of protecting data subjects rights. Will this be another red flag and enough to encourage privacy activists to challenge the EU Decision for adequacy? It seems unlikely at this juncture but it is certainly adding fuel to the fire.

The new ICO appointment

Back to the DCMS announcement, and the second part that confirms John Edwards, the current Privacy Commissioner for New Zealand, has been identified as the Government’s preferred candidate for UK Information Commissioner. He will appear before MPs on the DCMS Select Committee on 9 September 2021 for pre-appointment scrutiny. Barring any issues with this process it looks like the ICO will have a new boss in the not too distant future!

Rejigging the UK’s data laws?

The final part of the announcement trails a future consultation, building on the Innovation Strategy , “on changes to break down barriers to innovative and responsible uses of data so it can boost growth, especially for startups and small firms, speed up scientific discoveries and improve public services.” This appears where a lot of the comment has focussed so far with headlines about the removal of cookie banners and the UK “lowering standards” popping up all around the world. This may indeed be the proposal (albeit bearing in mind our comments above about the need to keep in touch with Europe this seems unlikely) but we will need to see the consultation itself before we know the actual extent to which this may be true, rather than relying on a soundbite.