Response to the call by DCMS for views on the potential implications of Brexit for Data Protection stakeholders: Brexit: Potential Implications for Digital and ‘Fintech’ Industries
Following the outcome of the historic ‘Brexit’ referendum on 23rd June 2016 in which a majority of eligible voters in the UK voted to ‘Leave,’[1] the United Kingdom is potentially on course to leave the European Union,[2] but to ensure continued economic success it will seek to maintain a favourable trading relationship with the EU. This article identifies and critically evaluates the various types of trade deals the UK might negotiate upon exit with a particular focus on trade in services since financial and digital services are key components of the UK economy. Also, as personal data processing underpins these service industries, particular attention will be paid to the data protection implications that would flow from such agreements. Specifically, it will be of assistance to Mr Matt Hancock, MP as it responds to his predecessor, Baroness Neville-Rolfe’s, call to ‘consider carefully what might be done either to replace it [Regulation (EU) 2016/679] if and when it ceases to have effect or, instead, if in the event it never comes into force. … the future might take several different forms and we need to identify as quickly as possible how to best react to whatever path is eventually chosen.’[3] This report offers both pre and post exit guidance on the data protection permutations of each type of trade deal. This timely analysis will be of use to policy makers, trade negotiators and businesses as they prepare for a trade and data protection legal landscape outside the European Union; one in which personal data will remain a key economic asset that will continue to be collected, processed and transferred across UK and EU borders. [1] Eligible voters in the UK voted to leave the EU by 52% to 48%. Leave won the majority of votes in England and Wales, whereas Remain won the majority of votes in Northern Ireland and Scotland; [2] Leading constitutional scholars and legal practitioners share the view that the referendum result is merely ‘advisory’ that is, the UK government would need to take further steps to formally notify the EU of its ‘decision’ to invoke Article 50 of the Treaty on European Union, and commence negotiations on a withdrawal agreement from the European Union with the European Council – a process that could take two (or more) further years to finalise. [3] DCMS, Speech by Baroness Neville-Rolfe DBE CMG, Parliamentary Under-Secretary of State for the Department for Business, Innovation and Skills and Minister for Intellectual Property, ‘The EU Data Protection Package: the UK Government’s perspective,’ at the Privacy Laws & Business Annual Conference on Data Protection (4th July 2016),