EU lawmakers concerned about EU citizens’ data transfer to UK
Members of the European Parliament have expressed concerns at the way the UK government handles personal data of EU citizens. The alarm was raised as the European Commission prepares to declare that British law guarantees “adequate” protection of personal information. The decision will allow to continue data transfer from the EU to the UK without requiring extra safeguards.
The issue was discussed on Monday, April 19, at the meeting of the European Parliament civil liberties and home affairs committee. In a resolution by committee chair Juan Fernando López Aguilar, MEPs warn about the restriction of data protection rights when it comes to UK immigration control.
The UK law allows to suspend the right of individuals to access their personal information held by authorities if this would “prejudice effective immigration control”. This exemption will affect everyone involved in a case about their immigration status, including EU citizens who live in the UK or will move to the country in the future.
Access to personal information is crucial in such cases to appeal Home Office decisions, for example regarding residence rights or deportation orders.
Already in February, the Parliament committee said in a non-binding opinion that the exemption “needed to be amended” before the Commission made a decision on the adequacy of the UK law.
MEPs are also “strongly concerned” about the potential transfer of personal information of EU citizens to countries that sign trade agreements with the UK but are not considered safe for data protection by the EU.
For instance, the EU has not issued “adequacy decisions” on eight of the eleven countries of the Comprehensive and Progressive Trans-Pacific Partnership (CPTTP), the trade bloc that the UK aims to join.
In addition, the UK has agreements with the US on the sharing of intelligence and personal information for law enforcement purposes. These risk allowing “undue access to the personal data of EU citizens and residents by US authorities,” MEPs say.
MEPs also worry about “mass surveillance programmes conducted by the UK intelligence agency”, not considered adequate under EU data protection law, and by public statements that the government “will seek to diverge from EU data protection rules” in the future.
Why an EU decision on UK data protection law is needed
Free flow of data is essential for trade, the provision of services, international staff recruitment, research, and for police cooperation on law enforcement.
“Volumes of data entering and leaving the UK increased 28 times between 2005 and 2015, and three-quarters of these data transfers are with EU countries”, says the Institute for Government.
The protection of personal data, from the name and address of a person to bank and health records, is recognized as a right of EU citizens under the EU’s Charter of Fundamental Rights. In addition, the EU has one of the most sophisticated data protection laws in the world, the General Data Protection Regulation (GDPR).
Under EU rules, personal data can be transferred to non-EU countries if their legislation is “adequate”, meaning it guarantees a similar protection. Otherwise extra safeguards, such as encryption, contractual clauses and codes of conduct, are required. These conditions create additional administrative burdens, and costs, for companies.
The EU Commission has so far recognised Andorra, Argentina, Canada (for commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay as providing adequate protection.
The US benefited of a system for the free flow of data for commercial purposes, but in July 2020 the Court of Justice of the EU declared it invalid because of the country’s extensive surveillance programmes.
New relationship with the UK
As the UK has left the European Union, the EU-UK trade and cooperation agreement established a 6-month transition period during which data continue to flow freely while the EU decides on the “adequacy” of the UK data protection law. The British government said it will continue to allow free data flows from the UK to the EU.
The European Commission has proposed to grant adequacy to the UK and to review the decision every four years to address possible deviations from current standards.
As part of the decision, the European Data Protection Board (EPBD), an independent body made of representatives of national data protection authorities, said that the UK is aligned with EU regulations having been part of the bloc, but the suspension of rights for immigration control and the onward transfers of personal data to third countries need further assessment.
EDPB director Dr Andrea Jelinek told MEPs that “it is paramount to maintain today’s alignment” between the UK and the EU legislation.
“If the UK data protection regime would at some point in the future diverge from EU standards, we must be prepared to act accordingly. For this very reason the Commission’s draft adequacy decisions are the first such decisions that limit the granted adequacy in time,” she argued.
The Board has also noted that a legal case on the “immigration exemption” is still pending and the Commission should take its outcomes into consideration.
Pending legal case
In 2018, the Open Rights Group, an organisation to protect the digital rights of individuals, and the3million, which focuses on the rights of EU citizens in the UK, launched a legal challenge requesting a judicial review of the UK data protection law.
The High Court ruled that the immigration control provision is not unlawful. But the groups are now appealing the decision.
Meanwhile, documents released by the Open Rights Group have shown that in 2020 the exemption was used in over 70% of data access requests to the Home Office.
The3million is especially concerned that the provision has been introduced at a time millions of EU citizens have to apply for a new residence status to secure their right to stay in the UK post-Brexit.
On Tuesday 27 April the European Parliament gave its consent to the EU-UK trade agreement. As regards data protection, the resolution calls on the Commission “not to adopt a positive adequacy decision if the conditions set under EU law and case law are not fully respected”.
The final decision will be made by the European Commission following the approval of EU member states representatives.
The European Parliament passed the resolution on the adequacy decision on 21 May 2021. On 28 June the Commission made the final decision but excluded from its scope transfers of data for the purposes of UK immigration control “in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area”. The Commission will reassess the need for this exclusion once the situation has been remedied.
Claudia Delpero © all rights reserved
Photo by Charles Deluvio on Unsplash
Europe Street News is an online magazine covering citizens’ rights in the EU and the UK. We are fully independent and we are committed to providing factual, accurate and reliable information. We believe citizens’ rights are at the core of democracy and information about these topics should be accessible to all. This is why our website and newsletter are available for free. A lot of research is behind every article, so if you found this useful, please consider making a contribution so we can continue and expand our coverage. Thank you!
