Rishi’s capital gains?

Writing in The Telegraph on Saturday 16 July 2022, former Chancellor and Conservative Party leadership candidate Rishi Sunak promised that of his 4 top priorities, one would be to “remove the burdens of GDPR, creating in its place the most dynamic data protection regime in the world”.

The justification was that “The EU’s Byzantine rules are preventing British tech companies from innovating and public services from sharing data to prevent crime… GDPR – with all its bureaucratic box-ticking – is clearly not working and needs to be replaced”.

This echoed comments he made last September, while giving a speech as Chancellor to the Treasury Connect conference which coincided with the launch of DCMS’ ‘Data: A New Direction’ consultation, when Sunak stated “We are in charge of our data protection rules now”, adding “You don’t need GDPR to have data adequacy”.  He stated that the Government’s aim was to “protect individual data but we don’t want to hinder innovation, and the whole view is that there are things that we can change that will be pro-innovation whilst protecting rights”.

Sunak is absolutely right that adherence to the letter of the GDPR is not a pre-requisite for a finding of data adequacy by the European Commission. Numerous countries, including Argentina, Israel and the Republic of Korea, have had their legal and data protection regimes found to offer essentially equivalent protection as the GDPR, and personal data may therefore be transferred to those countries without further safeguards. As we have pointed out, however, the Commission’s adequacy decision in respect of the UK was, uniquely, subject to a sunset clause and was explicitly stated to be based on the lack of divergence from the GDPR and “adherence to the European Convention of Human Rights and submission to the jurisdiction of the European Court of Human Rights”, both of which the UK intends to depart from in the Data Reform Bill and Bill of Rights. To maintain the UK’s adequacy Sunak, and the Government, will be reliant on equity of approach by the European Commission, but we know that countries like France have urged the Commission to implement policies in such a way that demonstrates that Britain has been disadvantaged by Brexit and its departure from the European Union. Implementation of the proposals involves a calculated assessment that the Commission will recognise that the value of the free flow of data between the EEA and the UK has a greater value than any potential punishment can impose. As the Commission looks to complete its Transatlantic Data Privacy Framework with the US, the timing of any further negotiations could be crucial, and making it a priority to revise the UK’s data protection regime and kick start any review of the UK’s adequacy could improve the UK’s hand.