Brexit: Where are we now?

This article sets out the "Brexit landscape" and what that means for data protection. 

Brexit Landscape

There has been some unfortunate rhetoric in the Brexit debate, linking the current situation with conflicts past. This post steers away from that. However, there is a phrase coined by Churchill which is a useful way of describing where we are in the Brexit process. “Now this is not the end,” he said, “it is not even the beginning of the end. But it is, perhaps, the end of the beginning.”

The day the UK leaves the EU will be the end of the beginning. If we do leave the EU, the negotiations over our future relationship are going to be far harder than the negotiations on the withdrawal agreement. As commentators have pointed out, they are also unprecedented. Most negotiations on trade agreements are about aligning standards and obtaining closer cooperation. The negotiations on the future relationship will, by contrast, be about how far away we move from the EU. That question has not yet been resolved at political level. The hardest negotiation, it has been said, is with your own side.

The position at EU level

Treaty choreography

At present the UK is still an EU member State, subject to the EU treaties. 

On or after 29th March (I think this date will slip), if the withdrawal agreement enters into force, we enter the transition period.

During the transition we will be subject to both the EU Treaties and the withdrawal treaty, which makes special arrangements as regards the UK during the transition period. 

Finally we will move to our future relationship with the EU. The treaty that governs that relationship has yet to be negotiated.

The withdrawal agreement and transition period

Under the withdrawal agreement, EU law will continue to apply to the UK as it does at present, with one very significant difference. During the transition period the UK won't have a seat at the table when the EU is deciding on legislation and other important issues, including those that affect the UK. 

This situation will continue throughout the transition period. The transition period lasts until 31st December 2020, but can be extended once for one or two years, so it could continue until 31st December 2022.

One aspect of the ratification of the withdrawal agreement which seems not to have been talked about all that much in the debate on Brexit is the fact that the European Parliament must also give its consent to the withdrawal agreement. There is no indication that it won’t, but this shows that the deal is not yet done at EU level. 

The framework for the future relationship

The framework for the future UK-EU relationship was published alongside the withdrawal agreement. The framework is not a legally binding document. It sets out in high level terms what a future EU-UK trade agreement might look like. During the transition period we will be negotiating that future relationship with the EU. The idea is to move seamlessly from the transition period into a relationship governed by that new treaty. The new treaty is described in the political declaration “an ambitious, broad, deep and flexible partnership”. 

Extension of the Article 50 process

It is now very likely that the Article 50 process will be extended (for reasons set out in more detail below).  An extension has to be done with the unanimity of all the member states. We won’t know whether we’ve got that extension until a few days before we are due to leave the EU. That decision will most likely be taken at the March European Council which is scheduled for 21-22nd March.

There have also been reports that Gina Miller, who brought the challenge on whether the Government could trigger Article 50 without parliamentary approval, has commissioned a legal opinion which argues that the EU council of ministers could itself unilaterally extend the Article 50 deadline. This is on the basis that this is permitted by the wording of Article 50 and because the EU has a legal duty to the Member States to ensure that any withdrawal is not damaging to the consistency, effectiveness and continuity of its policies and actions. 

European Parliamentary elections

An extension does however throw up other problems. There are European Parliamentary elections due to take place on 23- 26th May. The UK may still be a member state at that point. If the UK does not participate in those elections that may be a breach of EU law and this may result in legal proceedings, for example on the basis that the Parliament is not properly constituted under EU law and therefore that its decision making procedures are not in accordance with the EU treaties.   

Harmony and discord

It's worth mentioning that what might have been a difficult negotiation on the EU side as between the EU member states has in fact been remarkably cohesive. In fact it's been said that the Brexit talks have been a shot in the arm for the EU in the sense that they have worked as a unit on the negotiations. The same cannot be said for the debate in the UK. The referendum has left the country and its politicians deeply divided, with no consensus as to how to move forward, and no majority thus far for any particular outcome. 

Brexit at a UK domestic level

At this moment, days from our supposed “exit day”, the focus is very much on whether domestic politicians can come to a consensus that the withdrawal treaty and the framework for the future relationship should be agreed. The process UK politicians are currently wrestling with is set out in section 13 of the European Union (Withdrawal) Act 2018. 

Under that Act the Government won’t be able to ratify (that is finally agree) the withdrawal agreement unless three conditions have been met: 

• firstly, that the negotiated withdrawal agreement and the framework for the future relationship have been approved by a resolution of the house of commons otherwise known as the "meaningful vote"
• secondly, that a subsequent debate has taken place in the House of Lords,
• thirdly that Parliament has passed legislation to implement the Withdrawal Agreement.

On 15th January this year MPs held a meaningful vote on the Government’s deal with the EU and rejected it by 432 votes to 202.

After another debate and vote in the House of Commons on 29th January, the Prime Minister set out her intention to renegotiate the “Irish Backstop”. The backstop of course ties the UK to EU rules in order to maintain an open border in Ireland until such time as the terms of a  free trade agreement between the EU and UK make it unnecessary.  If the free trade agreement doesn't achieve this, then the UK potentially faces being trapped in a customs union with the EU, unable to strike trade deals around the world.  

So far reports suggest attempts to renegotiation the backstop have not been successful. The question remains whether there will nevertheless be a sufficient majority in Parliament to approve the deal.   

Meaningful vote

If the "meaningful vote" goes the Prime Minister's way and the withdrawal agreement is approved, then she is nonetheless not quite out of the woods. That is because there will be several more votes to be had in Parliament, before the deal can be finally ratified. 

European Union (Withdrawal Agreement) Bill

If the House votes for the deal, then domestic legislation is needed to implement it. Enter the European Union (Withdrawal Agreement) Bill. This is not to be confused with the European Union (Withdrawal) Act 2018, which is already on the statute book and turns EU law into national law in the event of a no deal Brexit. The European Union (Withdrawal Agreement) Bill by contrast implements the withdrawal agreement, and it has to be in place before the withdrawal agreement comes into force. That’s because the UK would be in breach of the withdrawal agreement on day one if it hadn’t been properly implemented in domestic law. 

Crucially for the transition period, the Bill saves those parts of the European communities Act 1972 which enable the UK to implement EU law and which allow directly effective EU law to continue to flow into UK national law.   That makes sense from a legal perspective: one would not want there to be any doubt about how EU law becomes national law during the transition period. But the continued application of the central provisions of the European Communities Act is also quite striking and doesn't necessary make for easy optics for some MPs.

Constitutional Reform and Governance Act 2010

Even if the European Union (Withdrawal Agreement) Bill becomes law there is a further domestic hurdle which must be overcome before the withdrawal agreement is ratified. 

The Government has confirmed that Parliament will also need to ratify the withdrawal agreement before exit day in accordance with the Constitutional Reform and Governance Act 2010. This sets out a procedure for the ratification of treaties. 

The process under the Act is that the withdrawal agreement is laid before Parliament for 21 sitting days (as opposed to calendar days). If within those 21 days either House votes not to ratify the treaty, the Government has to set out why it believes that the treaty should nevertheless be ratified. This triggers a further 21 day sitting period. If the Commons votes again not to ratify the treaty then the whole process repeats and could go on indefinitely. The Commons can thus block ratification of the treaty. There are exceptions to this process, but the Government has already confirmed that it will be honoured.  

Therefore even if the withdrawal agreement is approved by Parliament it seems inevitable that the Article 50 process will need to be extended in order to ensure that everything is in place so that the withdrawal agreement can be ratified and enter into force. 

No deal? Extension?

If the deal doesn’t get through, the intention was that there would be a vote in Parliament on whether the UK should leave the EU without a deal.  Commentators consider that Parliament would be likely to vote to stop a no deal Brexit. There would then be a vote on whether the Article 50 process should be extended. However, recent reports suggest that in the event that the "meaningful vote" is against approving the withdrawal agreement then the Prime Minister will offer to secure an extension to the Article 50 process. The EU has of course said that in order to gain an extension the UK would need to have a plan.  Consensus for a plan seems difficult to secure at present and a short extension of the Article 50 process (until June, for example) may not move things forward very much. It's quite possible that the EU would demand that any extension was much longer. There have been reports that a period of two years has been mooted. This would clearly be unacceptable to some. If we were absolutely at the cliff edge and had no plan it would of course be possible for the UK to simply revoke the Article 50 notice. The Court of Justice of the European Union has confirmed that this could be done. This feels like an unlikely option, but it cannot be ruled out.  Neither, of course, can a disorderly, no deal exit.

What does this mean for data protection?

Deal

If we have a deal then things will continue more or less as normal. But there are some very significant exceptions to this, in terms of the UK's presence at the table and influence during the transition period. 

One stop shop

Looking now specifically at certain features of the GDPR and in particular the one stop shop, the headline is that the UK will be able to continue to participate in the one stop shop during the transition period. There is nothing in the withdrawal agreement that prevents that. Note that Article 128 which deals with the institutional arrangements during the transition refers to Annex VII. Annex VII lists the legislation under which the UK may no longer act as a lead authority. The GDPR is not listed there. This means that the UK Information Commissioner can continue to act as a lead authority under the one stop shop during the transition period.

Note also that although the general rule is that the UK has no seat at the table, exceptionally, the Information commissioner could attend the EDPB. The withdrawal agreement allows for this where the presence of the UK is necessary for the effective implementation of Union law during the transition period (see Article 128(5)(b)). So if the Information Commissioner's presence was needed in order to ensure the proper operation of the one stop shop, she could attend a meeting of the EDPB during the transition period. 

BCRs

Equally there is nothing to stop the Information Commissioner dealing with binding corporate rules during the transition period. The only caveat to that is that BCRS take time. If it looks as if that process won’t be finished until after the end of the transition period then it may need to transfer to another regulator, but that shouldn’t cause a significant problem.

Framework for the future relationship and data

EU adequacy decision for the UK

We shouldn’t of course consider the transition period without thinking what we would be transitioning to. The framework for the future relationship sets out that the adequacy process for the UK should begin as soon as we leave the EU. On the face of it one might expect that the adoption of an adequacy decision in relation to the UK would be relatively unproblematic. Given that the EU and UK data protection regimes would be aligned, one would expect that the UK would easily meet the test that its data protection regime was "essentially equivalent" to that of the EU. 

However, as has already been well publicised, there is concern that the path to an adequacy decision for the UK is far from smooth. 

In considering possible barriers to an adequacy decision the Home Affairs Select Committee cited the following potential stumbling blocks: 

• firstly, the UK's national security legislation, in particular the Investigatory Powers Act 2016;
• secondly, the fact that the EU's Charter of Fundamental Rights will not become domestic law through the European Union (Withdrawal) Act 2018, but is an exception to the savings mechanism set out in that Act;
• thirdly, the Data Protection Act 2018, in particular exceptions for immigration law;
• fourthly, onward transfers, including to the USA; and
• finally, Government red lines on the future jurisdiction of the Court of Justice of the European Union.

In terms of the Investigatory Powers Act 2016, the Information Commissioner has described this legislation as a "vulnerability to achieving adequacy". As a member state the UK was able to keep the EU out of the national security sphere, because this area is outside EU competence. However, the national security arrangements of a third country are relevant matters to be taken into account in the context of a decision whether or not to grant adequacy.  

In relation to the fact that the European Union (Withdrawal) Act 2018 has not preserved the Charter of Fundamental Rights in UK law, I am sceptical that this would be a stumbling block in reality. The Charter does not apply in other third countries. So it would be surprising if this factor compromised the UK's ability to obtain an adequacy decision. On the other hand the continued application of the Charter would no doubt have been helpful to some degree in securing adequacy. The same sort of reasoning applies in relation to the jurisdiction of the CJEU. Third countries which are adequate are not directly subject to CJEU jurisdiction. So accepting CJEU jurisdiction would no doubt have been helpful for obtaining adequacy. But the absence of CJEU jurisdiction is unlikely, in my view, to be pivotal in the negotiations on adequacy.

Cooperation between regulators

In terms of regulatory cooperation in the future relationship, this is explicitly mentioned in the framework for the future relationship. No doubt it makes sense for EU and UK regulators to cooperate closely in the future. We are after all situated very closely to the European continent and there is no doubt that trade with the EU will be important post our exit from the EU. But it's clear from the EU's position that this cannot amount to having a say in the EDPB or benefitting from the intra EU mechanisms such as the one stop shop. It will be a more distant form of cooperation in the future.

No deal and data

Turning now to no deal. No deal is dramatic. Overnight, our reciprocal rights and obligations with the EU would be ripped up. Sir Ivan Rogers, our previous ambassador to the EU has talked about how the EU reaches into every nook and cranny of our lives. So the sudden ending of those rights and obligations is unlikely to unproblematic. The European Union (Withdrawal) Act 2018 mitigates the effect of that sudden ending by saving EU legislation, so that the same standards apply in the UK after exit day as they did before. But it cannot save the central aim of that legislation which is at its core about harmonising standards across the EU. 

Whilst the continuity provided by the European Union (Withdrawal) Act 2018 is essential, the creation of domestic law which mirrors EU law throws up further difficulties and complexities. In terms of data protection, we will end up with  two versions of the GDPR: the UK GDPR and the EU version of the GDPR. This could create real difficulties for controllers and processors if and when (as is inevitable) the two "versions" of the GDPR start to diverge. For example, a UK business trading in both the EU and France will be subject to the UK GDPR but may also be subject to the EU version of the GDPR through the operation of the provisions on extra territorial scope. Those two regimes will start to move apart after exit day, in particular UK courts are likely to be in a position to interpret provisions of the UK GDPR more quickly than the CJEU is able to interpret the EU version, given that the preliminary reference procedure will move more slowly. That creates the possibility of an interesting dialogue between our domestic courts and the CJEU, but also, crucially, it may mean that businesses end up having to interpret what is essentially the same regime in different ways. 

Data flows in a no deal situation

UK to EU/third countries

In terms of data flows in a no deal situation, there is no change as regards data flows from the UK to the EU. That is because the UK has deemed the EU to be adequate under the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (these are made under section 8 of the European Union (Withdrawal) Act 2018 and make amendments to data protection legislation so as to ensure that it works as domestic law post exit, for example by changes references to the EU institutions to references to UK entities). 

Given that the UK GDPR mirrors the EU's GDPR, the familiar tools for sending data from the UK to third countries still remain. EU adequacy decisions can still be relied upon as they could prior to exit day. But there are two caveats to that. Where making transfers from the UK to the US relying on privacy shield, controllers and processors will need to make sure that the US entity has updated its public commitments to expressly state that those commitments apply to transfers of personal data from the UK. Secondly there is still a lack of clarity as to what is happening in relation to the Japan adequacy decision, and whether UK controllers will be able to rely on this. 

Model clauses will still be capable of being used, as will the derogations, although they can only be used in limited circumstances. Binding corporate rules can also be used, although in order to ensure that they remain acceptable to EU regulators as well as in the UK changes  may need to be made, such as ensuring that the liability accepting entity is in the EU if that entity was previously a UK entity.

EU to UK data flows

EU to UK data flows are more complex. Adequacy won't be available immediately on exit from the EU because those negotiations won't start until the UK has left the EU and may take some time. 

The optimum data transfer mechanism is therefore model clauses. Again, derogations are limited in scope so may not be available.  BCRs would also be available, but may need to be amended. 

Further issues – data and no deal

There are other issues to be aware of for no deal. Controllers and processors who are caught by the GDPR through its extra territorial provisions, and who had a representative in the UK, will need a representative in the EU in order to comply with the GDPR. Controllers and processors who are caught by the extra territorial provisions of the UK GDPR will need to appoint a representative in the UK if they only had a representative in the EU. There is of course a separate debate about the extent to which this obligation is honoured in practice. 

In a no deal situation the UK information commissioner won't have a seat at the European Data Protection Board. If the UK information commissioner was a lead authority under the one stop shop mechanism then this will no longer be the case on a no deal exit. The one stop shop does not apply to entities outside the EU or EEA.

The UK information commissioner will also be unable to approve EU BCRS.

Conclusion

The headline is that we are only nearing the end of the beginning. Even if the withdrawal agreement scrapes through the meaningful vote next week, there are lots of votes between that vote and eventual ratification. An extension to the article 50 process is likely to be granted, but it's not without problems given the timing of the European parliamentary elections. 

It's unlikely that the UK will fall out of the EU without a deal, but it makes sense to have contingency plans at the ready, just in case. 

If the UK does leave the EU, however that is done, deal or no deal, the negotiations on the future relationship will be much harder than the negotiation on the withdrawal agreement has been, and hardest of all, perhaps, at a domestic level because there is no consensus as to where we are heading once we have left.  There is uncertainty ahead.

Eleonor Duhs

9th March 2019