Last week, the European Commission published the text of the new Privacy Shield, which will govern the lawful transfer of data between the EU and US following the abolition of the previous data sharing agreement, Safe Harbour, by a ruling of the European Court of Justice (ECJ). A few days later, the UK government published an updated version of the Investigatory Powers Bill (the so-called ‘snoopers’ charter’) for presentation to parliament.
Privacy Shield covers the obligations of non-EU commercial organizations and governments when handling data of EU citizens. The Investigatory Powers Bill will regulate the role of security services and police in the UK for UK citizens’ data. Should Britain vote to leave the EU in the forthcoming referendum, the interplay of between these two could be devastating for UK digital industries.
Legislation at odds
Privacy advocates have derided Privacy Shield as gutless, but weak as it may be, the draft adequacy decision goes out of its way to emphasize how limited bulk data collection will be: ‘limited to (exceptional) situations where targeted collection is not possible’. The document repeatedly states that targeted collection will be preferred over bulk, and that collection will be ‘narrowly focused’ relating to ‘individually identified legitimate targets’.
In contrast, despite the recommendations of the three committees tasked to review it, the Investigatory Powers Bill published last week retains highly controversial proposals for bulk collection, bulk interception and equipment interference. The draft bill provides for no preference for targeted surveillance over bulk collection, it does not limit bulk collection or access to situations where it is strictly necessary, or where there is no alternative.
Yes, the draft bill provides for strengthened oversight compared to the situation now, but by vesting the power to issue warrants in the home secretary rather than judges, the bill risks falling foul of the European Court of Human Rights’ ruling that such ‘eminently political’ supervision ‘is inherently incapable’ of providing the necessary guarantees and safeguards for human rights.
Low leverage
There was a strong mutual interest for the EU and US to move quickly to restore lawful cross border data sharing after Safe Harbour was invalidated. Like the rest of the world, EU citizens are highly reliant on US web platforms. In nearly every EU country, the top three most visited websites are American: Google, Facebook and YouTube. Stopping transatlantic data flows would severely affect the lives of European citizens. It would also have a major financial impact on US companies to locked out of the largest economic bloc in the world.
Although digital industries represent 10 per cent of Britain’s GDP, the highest percentage of any G20 member, the EU is far less reliant on the UK’s digital exports than on big US tech companies. But if data flows between Britain and the EU are impeded, it will adversely affect British economic interests − e-commerce was valued at 20 per cent of British business turnover in 2014 according to the Office for National Statistics.
Plus, data sharing has an impact on all business with the EU (both online and offline), valued at 45 per cent of UK exports and 53 per cent of UK imports. New data protection regulations will guarantee EU citizens the same level of protection wherever their data is processed. Order books, sales and purchase records all involve the processing of personal data.
Trouble ahead
Should the British vote to leave, data transfer would no doubt form part of lengthy negotiations covering all aspects of the UK’s relationship with the EU. Meanwhile, the market would move without waiting for the politicians. When the ECJ abolished Safe Harbour, large (US) cloud providers quickly began offering guaranteed hosting in the EU, long before Privacy Shield was agreed.
During the uncertain period following the referendum, international providers are likely to move data out of the UK in a similar way. Meanwhile UK companies, rather than enjoying a reduction in Brussels red tape after Brexit, would still be bound by EU regulations when handling the data of EU citizens, as well as facing barriers to data transfer.
This is unlikely to be a temporary problem. The reason why the ECJ ruled Safe Harbour invalid was because of US practices of mass data retention and sharing with law enforcement, as exposed by Edward Snowden. The so-called ‘snooper’s charter’ proposes to enshrine in law equivalent practices, plus more intrusive powers to inspect internet connection records.
If it becomes law, a post-Brexit UK would be unlikely to meet the standards required for Privacy Shield status. This would prohibit cross border data transfers between UK and EU. Even if there is some cobbled together agreement, Britain may find its former EU partners less willing to jump to the negotiating table to rescue UK economic interests. British business would continue to face barriers, and British citizens would end up with fewer protections than EU citizens against UK government intrusion.
Emily Taylor, Associate Fellow, International Security (Chatham House).