The House of Lords European Union Committee has published its 3rd Report of Session 2017-19 on “Brexit: the EU data protection package” which considers the impact of Brexit on the General Data Protection Regulation ((EU) 2016/679) (GDPR), the Police and Criminal Justice Directive ((EU) 95/46/EC) (PJC Directive), the EU-US Privacy Shield and the EU-US Umbrella Agreement. When the UK leaves the EU, it will no longer be bound by the EU’s data protection laws nor will it be a party to the EU-US Privacy Shield or the EU-US Umbrella Agreement. However, this does not mean that EU data protection rules can be ignored.

The report’s key findings and recommendations include: that the Committee supports the UK government’s stance in maintaining unhindered data flows post-Brexit but it was struck by the lack of detail on achieving delivery and the UK government must explain as soon as possible how it intends to achieve its aim; any post-Brexit arrangement that leads to friction around UK-EU data flows could pose a non-tariff barrier to trade putting the UK at a competitive disadvantage; the government should pursue “adequacy” decisions confirming that the UK’s data protection rules offer an equivalent standard of protection to that available within the EU and should put in place transitional arrangements to cover the gap between leaving the EU and obtaining adequacy decisions; the government replace structures and platforms to retain UK influence and as a starting point it should aim to secure a continuing role for the UK Information Commissioner’s Office on the European Data Protection Board; and any impediments to data sharing could hinder policy and security co-operation.

This report arises out of routine scrutiny of EU legislative proposals but also forms part of a co-ordinated series of Brexit-themed inquires following the UK’s decision to leave the EU.

Chris Evans, Consultant

 This briefing was posted on 24 July 2017.