Duhs, Eleonor

SOAS Research Online

SOAS ICOP Policy Briefings   To Inform Government and Parliamentary Debates For further information contact the author at e.duhs@bateswells.co.uk. Contact Prof Alison Scott-Baumann for access to other experts at as150@soas.ac.uk, and visit our website for more information. The views expressed in SOAS ICOP Briefings are those of the authors and do not necessarily represent those of SOAS. The Draft Data Protection Act 2018 (Amendment of Schedule 1 Exemptions) Regulations 2024 – Clear Evidence of Falling UK Data Protection Standards by Eleonor Duhs, Barrister, Partner and Head of Privacy at Bates Wells (28th February 2024) The free flow of personal data across borders is essential to the modern economy. Finance, banking, retail and hospitality all depend on it. The free flow of data between the UK and its biggest trading partner, the EU, is therefore of crucial importance. Reforms to the UK’s data protection frameworks could put EU-UK data flows at risk. A lack of free flow of personal data from the EU to the UK could cost UK business up to £1.6bn. It could also lead to the suspension of the law enforcement cooperation mechanisms in the EU-UK Trade and Cooperation Agreement (see Article 693), thereby making citizens on both sides of the Channel less safe.  Provisions of the EU-UK Withdrawal Agreement will kick in if the UK loses the free flow of data from the EU (see Article 71) and will also create operational headaches for UK businesses. These obligations would require UK businesses to navigate different data protection standards, depending on where the data they are processing originated. Currently, there is a free flow of data from the EU to the UK for both general and law enforcement data processing. This is because the EU has assessed the UK’s frameworks as providing an essentially equivalent level of protection of personal data to that in the EU.  The basis for this assessment is that the UK’s data protection regime (the UK GDPR and the Data Protection Act 2018) mirror and adhere to the standards set out in the EU’s data protection frameworks. But the draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (“the Regulations”) clearly illustrate the extent to which data protection rights in the UK have fallen since certain provisions of the Retained EU Law (Revocation and Reform) Act 2023 (“REULA”) came into force at the end of last year.  Before the end of 2023, the hierarchy that existed between pre-Brexit domestic law and what had been EU law was preserved through the vehicle of the European Union (Withdrawal) Act 2018.  The Open Rights case  (which led to the drafting of the Regulations) relied on this preserved hierarchy to argue that the immigration exemption in Schedule 2 to the Data Protection Act 2018 was unlawful because it was too broad and did not contain sufficient safeguards for data subjects as was required in Article 23 of the UK GDPR.  This argument can no longer be made because the REULA has turned the statue book on its head.  From the end of 2023, domestic law (whenever enacted) has taken precedence over what used to be EU law. This means that other broadly drafted exemptions in, which apply to data being processed across the public and private sector, now trump the safeguards prescribed in Article 23 of the UK GDPR, thus lowering the standard of protection (see further details here).   MPs are urged to use the affirmative debate on the Regulations to point out that the safeguards which the Regulations afford to individuals in the context of immigration should be replicated across all areas of society and for all data subjects. The government should use the vehicle of the Data Protection and Digital Information Bill, which will be debated at Committee Stage in the Lords in March, to restore data protection rights in the UK to what they were before the end of 2023.  This would also ensure that the UK’s data protection standards do not fall below those in the EU, thus ensuring that there is no risk to the free flow of data from the EU to the UK.  

The Draft Data Protection Act 2018 (Amendment of Schedule 1 Exemptions) Regulations 2024 – Clear Evidence of Falling UK Data Protection Standards

https://eprints.soas.ac.uk/41512/1/Draft%20Data%20Protection%20Act%202018%20%28Amendment%20of%20Schedule%202%20Exemptions%29%20Regulations%202024%20-%20270224.pdf

The Draft Data Protection Act 2018 (Amendment of Schedule 1 Exemptions) Regulations 2024 – Clear Evidence of Falling UK Data Protection Standards

Abstract

Similar works

Full text

Available Versions

SOAS Research Online