The ink is barely dry on Brussels’ preliminary data flows deal with the United Kingdom, but activists are already urging officials to get out the Tipp-Ex.
In submissions to the European Commission and the bloc’s data protection regulators today, British non-profit collective the Open Rights Group demanded stricter privacy standards for immigrants under the U.K.’s privacy framework before the data flows deal is finalized.
“We have always worried that the Immigration Exemption is a blunt instrument,” said Matthew Rice of the ORG. He was referring to a carve-out in U.K. data protection law that waives rights for certain cases involving immigrants’ data.
“We are raising these issues with the European Commission and the European Data Protection Board to demand the removal of the exemption or at the very least to set out clear amendments that need to be made,” Rice said.
The European Commission gave its preliminary approval to Britain’s data protection standards, in what is called an adequacy decision, in mid-February. The approval must now be scrutinized by Europe’s data protection regulators and receive a sign-off from national capitals before cross-Channel data flows are guaranteed. (The guarantee lasts for four years before the process will have to be repeated).
According to ORG research seen by POLITICO, the British government used the immigration exemption to turn down access-to-data requests seven out of 10 times in 2020. The non-profit also found that the number of appeals against the use of the exemption was tiny in comparison to the number of data requests made — decisions were appealed three times in the last two years, compared to 20,000 requests in 2020 alone.
For Rice, the large disparity between the number of appeals and requests suggests the exemption “is being used without proper safeguards,” such as notifying the individual. “The high number of applications compared to the tiny number of appeals needs to be investigated,” he said.
In a sign that the EU’s executive will have a tough time convincing skeptics that it was right to give the U.K. data regime the green light, British academics also published a paper today criticizing the deal.
In a blogpost Wednesday, academics Ian Brown and Douwe Korff said the adequacy decision could lead to the U.K. becoming a “data protection-evasion haven,” acting as a funnel for EU data to be sent onwards to countries that have lower standards.
Comments by U.K. Secretary of State for Digital Oliver Dowden in the Financial Times earlier this week will have done little to assuage those concerns.
The U.K. could now be “more agile” than the EU in striking international data agreements, he said, allowing it to “capitalize on a multibillion-pound opportunity to boost trade in sectors where physical distance is no object.”
“It would be a serious mistake for the EU Member States … to approve this decision, allowing personal data to flow freely from the European Economic Area countries to the U.K.,” the academics’ blogpost reads.