The Minister for Digital and the Creative Industries (Margot James)
I thank the hon. Member for Bristol North West for running through the European Scrutiny Committee’s proposals for this afternoon’s debate. My colleague the Minister for Trade Policy and I welcome the opportunity to debate this important subject. The cross-cutting nature of data in trade agreements and its significance for our Departments mean that we will both make an opening statement and participate in the question-and-answer session. We have agreed to be brief and to stay within the conventional 10 minutes.
The free flow of data, with citizens who are rightly confident that their data, particularly their personal data, will be protected, is integral to our economy and vital for law enforcement co-operation before, during and post Brexit. The amount of data that we generate as citizens and businesses is increasing rapidly. Data flows help to ensure not only that people get paid and that health services can co-operate, but that people can live their lives. They affect all consumers and businesses. As we leave the EU, the UK will continue to be at the forefront of driving up standards and protecting individual citizens’ privacy, while ensuring that data continues to grow and be processed legally.
Many of the issues that we will touch on came up during the passage of our Data Protection Act 2018, and we welcomed the debates in the House on citizens’ privacy rights. I am proud of the Act, of our world-class regulator and that the UK has high standards of data protection, in line with the GDPR and the law enforcement directive. The Government have solidified the UK’s presence as a global leader in data protection. As such, we laid the foundations to forge trade agreements and take up a leadership role in promoting the free flow of data with high data protection standards. We believe that the provisions of trade agreements on the free flow of data and robust data protection frameworks are not in conflict. In fact, they should be mutually reinforcing. The Government have worked with the European Commission and member states to push for ambitious data clauses in trade deals to reduce protectionist barriers. We continue to engage with the Commission on their proposals.
The Government are looking forward to striking trade deals with provisions that lower barriers to cross-border data flow and, in particular, to deal with data localisation requirements, which can act as a protectionist force, locking companies out of overseas markets. We want to see data flow freely across national boundaries to allow enterprise, new ideas and economies to flourish within the close confines of data protection. That approach will align us with the growing digital economy in the European Union while opening up new opportunities in other fast-growing regions of the world.
I look forward to our debate. Negotiations with the European Union are live, so my hon. Friend the Minister for Trade Policy and I are somewhat constrained in what we can say, but I hope we can give the Committee enough detail during questions as we set out with clarity the advantages of our data and trade policy.
The Minister for Trade Policy (George Hollingbery)
The free flow of data, including personal data, is crucial to international co-operation and trade in the modern world, but it must be underpinned by high data protection standards. Because so much digital data involved in business and trade today includes at least some personal data, it is vital that the UK pursues trade rules in this area that provide clarity and certainty to industry and individuals so that personal data may continue to flow securely and freely while remaining protected.
I want to emphasise how the Government are committed to facilitating data flows as a key driver of global trade and the lifeblood of today’s digitalised economies while ensuring that rights to data protection and privacy are safeguarded. Data flows are vital not only to high-tech industries but to traditional sectors, goods and services. A trade framework for the UK and its international trading partners that includes robust commitments enabling cross-border data transfers and prohibiting data localisation is therefore critical for the UK’s future prosperity and economic growth. Even with the vast and numerous benefits to companies, consumers and economies that arise from the ability of organisations to share data easily across borders, dozens of countries are erecting unjustified barriers to cross-border data flows, such as data localisation requirements that seek to confine data within borders. Such a strategy can have a detrimental effect on the free flow of data. Trade agreements that include substantive provisions designed to enable data flow do not undermine data protection or privacy; on the contrary, such provisions tend to reinforce and safeguard protections for personal data and privacy.
Trade provisions often make clear that they do not prevent data from being subjected to data protection regimes and are therefore complementary to data protection and privacy. Countries should therefore be able to apply legitimate measures to protect data travelling to third countries. However, such international transfer regimes can facilitate or hinder the ability of countries to take advantage of trade measures on the grounds of privacy and the right to data protection.
After a period of some years and intense internal debate, we welcome the European Commission’s initiative in tabling proposals on cross-border data flows in trade agreements. That has been a sticking point in the Commission and the EU for a number of years. In particular, we welcome provisions designed to tackle unjustified data localisation requirements, which often serve to reduce trade with and new investment in trading partners, thereby depressing economic development. Although the UK Government see the provisions as a good starting point, we will look to be a world leader in setting clear and ambitious provisions in future trade agreements in this area as well as to shape the new global standards for modern free trade agreements.
Finally, I will have a crack at answering some of the questions from the hon. Member for Bristol North West. We very much welcome the EU’s position, as it has crystallised some of its thoughts and published a substantive text for the first time for use within the EU-Indonesia free trade agreement. We are looking for ambitious provisions to facilitate data flow and ensure that the playing field is level in areas such as data localisation. Any agreement will have to ensure that the high levels of personal data protection are not put at risk. As I am sure the hon. Gentleman knows well, the GDPR will be directly applicable in UK law straight after Brexit; it will be adopted as our standard. Trade provisions will therefore not form a legal basis for transfers of personal data. In short, we will lay the pipework and allow the playing field to be laid so that data can flow fairly across borders, but it is for others—the Department for Digital, Culture, Media and Sport, other authorities and other third-party countries—to turn the taps on or off.
The Chair
We now move on to questions to the Ministers. As we have two Ministers, perhaps Members could indicate which one they are directing their question at. This will go on until 3.37 pm, unless we get a Division, in which case injury time will be added.
Liam Byrne
Of course; I appreciate that, Mr Evans.
Like me, my hon. Friend will have been alarmed by the catena of platitudes from both Ministers this afternoon about the importance of data, the importance of trade and the importance of data to trade. We heard absolutely nothing about whether the Ministers are confident of securing an adequacy agreement, especially in the event of a no deal Brexit. As is eloquently set out in the paperwork for today’s hearing, the Ministers know as well as we do that this has to be signed off not only by the European Commission, but by the European Parliament, the article 29 working group and the European data protection supervisor.
Given the imminence of Brexit, I am extremely concerned that we have heard nothing about a timetable or a level of confidence. My question is blunt: in the event of a no deal Brexit, are the Ministers prepared to guarantee to the House this afternoon that a data adequacy agreement will be secured and that free data flows will continue?
Margot James
I thank the right hon. Gentleman for his question. I cannot give him a categorical assurance that an adequacy agreement will be in place at any particular point during the negotiations. I can tell him that the UK Government have made it clear to the Commission that we are ready to commence discussions on a future adequacy agreement, even though the Commission has not indicated that it is yet ready to start such discussions. If we are successful in securing the transition and implementation period, we will stand ready to begin those preliminary discussions on an adequacy assessment during that period. Indeed, we stand ready now, but the Commission has indicated that it is not yet ready.
We agree that our primary goal is to secure an adequacy agreement. Through the recent publication of a technical notice, we have various provisions in place that should allow for the free transfer of data during the period in which we are discussing adequacy but have not yet secured it.
Liam Byrne
I do not know whether you prefer me to ask these questions standing up or sitting down, Mr Evans.
Liam Byrne
Thank you, Mr Evans. I am grateful for the Minister’s answer, but perhaps she could go further and tell us the precise timetable her officials have given her for what needs to be agreed when. Ultimately, we need to know when an adequacy agreement needs to be in place to ensure the free flow of data after we have left the European Union, which the Prime Minister assures us will happen at the end of March. Given that long stop date, as it were, what is the timetable for securing the necessary agreements from the European Parliament, the article 29 working party and the European data protection supervisor?
Margot James
As I said, the UK is ready to begin preliminary discussions on an adequacy assessment now. I cannot give a cast-iron timetable, because I cannot speak for the European Commission, which is the vital party to such discussions. The ball is in its court. We have indicated that we are ready and willing to start adequacy discussions. We anticipate that those discussions will take place during the transition and implementation period. Through the technical notice, we have established the arrangements that we would put in place if there were to be a gap between our departure from the European Union and the timing of the future framework. We all know what is going on—on both sides—on many fronts, not just data protection.
Liam Byrne
My last question is to press the Minister on a single point: by what date must an adequacy agreement be reached and in place to ensure that the free flow of data continues?
Margot James
The Government will ensure the free flow of data, even if there is a gap between the time at which the United Kingdom obtains an adequacy decision and the time at which we leave the European Union. We are scheduled to leave the European Union at the end of March next year. We anticipate that there will be an implementation period that takes us a further 20 months. During that implementation period, we anticipate discussions with the Commission on an adequacy decision.
We cannot guarantee exactly when that adequacy decision will be made. I reassure all members of the Committee that on our departure from the European Union we will be 100% aligned with European data protection law, particularly the provisions of the GDPR. The right hon. Member for Birmingham, Hodge Hill and I shared many discussions during proceedings on the Bill. When it received Royal Assent in May this year, it put us in 100% alignment with EU data protection law. We can be optimistic that an adequacy decision will not require the usual length of time that it takes the Commission to bestow such decisions on other third countries. However, the right hon. Gentleman will understand that I cannot give a guarantee on that, because to do so is not in the UK Government’s gift. The decision will be forthcoming from the European Union.
If the right hon. Gentleman wants me to tell members of the Committee what will happen if we do not have an adequacy decision, either as we leave the European Union next March or even after the implementation period, I am happy to do so, but he looks as though he wants to intervene.
Liam Byrne
I am much less sanguine than the Minister about the possibility of an adequacy agreement. As she knows, we will not have article 8 to rest on after we leave the European Union. We have also sketched into the Data Protection Act 2018 sweeping exemptions from the GDPR for anyone who happens to be an immigrant, so I think the European Parliament will have some serious questions for the Minister about the adequacy agreement. Do we need an adequacy agreement in place to cover the implementation period, or not?
Margot James
I am not sanguine about anything to do with this; it is a serious matter. I may be optimistic, but there is a lot of work to be done, and I cannot guarantee when an adequacy decision will be made. I can only state categorically that it is the Government’s intention to prioritise discussions in relation to adequacy with the European Union, such that we get an adequacy decision as soon as it is practically possible for the European Commission to grant us one.
We have put in place some exemptions to the GDPR, as have other member states, but we have done so in a framework that permits member states to apply such derogations and exemptions. Other member states will have put in place similar or different exemptions. I contest the right hon. Gentleman’s statement that the exemptions are “sweeping” in respect of immigration. I remember the debates well. The powers are extremely contained, and they were amended on Report to constrain them even further.
I can answer questions about the measures that we will put in place if there is a gap between the granting of an adequacy decision and our departure from the European Union—and, indeed, after the implementation period, assuming the implementation period is agreed.
Motion made, and Question proposed,
That the Committee takes note of European Union Document No. 5191/17, a Communication from the Commission to the European Parliament and Council on Exchanging and Protecting Data in a Globalised World, and an Unnumbered European Union proposal for provisions on Cross-border data flows and protection of personal data and privacy; welcomes the adequacy framework as an effective means of ensuring a free flow of data from the EU to third countries; and further notes that in the context of the UK leaving the EU it provides the right starting point.—(Margot James.)
Margot James
I have made my opening statement and I have answered questions. I have indicated my willingness to answer further questions, should they arise during the debate, but I have nothing further to say at this stage.