Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, what estimate he has made of the number of UK firms that import data from the EU that would be subject to the EU's rules on data export to third countries in the absence of an adequacy decision.

We are currently undertaking analysis regarding the number of businesses this will affect.

The UK and the EU agree that the continued free flow of personal data is an important underpinning feature of the future relationship for both economic and security purposes. In 2017, around 40% of the EU’s service exports to the UK were data-enabled worth approximately £30bn, and around 70% of the UK’s service exports to the EU were data-enabled, worth approximately £80bn. This demonstrates that it is in everyone’s interests that the exchange of personal data between EU Member States and the UK continues in the event of a no deal scenario. The EU has an established mechanism to allow the free flow of personal data to countries outside the EU, namely adequacy decisions and the UK stands ready to begin the adequacy assessment process right away.

In the event of no deal, given the degree of alignment between the UK and EU’s data protection regimes, the UK will transitionally recognise all EEA states, EU adequate third countries, EU and EEA institutions, and Gibraltar, as though they have been subject to an affirmative adequacy decision by the UK. This will allow personal data to continue to flow freely from the UK to the EU. The UK would keep all of these decisions under review.

In a no deal scenario, the UK does not expect the European Commission to have made adequacy decisions regarding the UK at the point of exit. This means UK and EU organisations should take steps to mitigate any impact in this scenario by implementing alternative transfer mechanisms to send personal data from the EU to the UK. Details of what the alternative transfer mechanisms available are and how to make use of them are set out in the ICO guidance and gov.uk.