Executive Vice-President Vera Jourova
Commissioner Didier Reynders
Rue de la Loi 2001049 Brussels
Belgium
Cc
Bruno Gencarelli, Head of International Data Flows, DG Just
Re: Reassessment of UK adequacy decision in light of dangerous UK data bill
Dear Executive Vice President Jourova,
Dear Commissioner Reynders,
The undersigned organisations and individuals are deeply concerned about the UK government’s Data Protection and Digital Information (DPDI) Bill, which would turn the UK into a “leaky valve” that undermines the data protection rights of European citizens.
In June 2021, an adequacy decision was granted to the UK allowing the free flow of personal data to and from the United Kingdom without additional safeguards. This decision, granted by the Commission, rested on the premise that the UK's data protection system would continue to follow the same rules as when the UK was an EU Member State.
The DPDI Bill flies in the face of the 2021 adequacy decision. If passed, the Bill would mean a wholesale deregulation of the UK data protection framework, allowing private companies to seek shelter in the UK to circumvent European data protection standards, and turning the UK into a “test lab” for experimental and abusive uses of data. Likewise, the UK Government would be given the power to legalise invasive surveillance programmes and other measures that trump the right to data protection of European citizens.
The Commission must urgently take stock of these changes, which directly contradict key elements of data protection adequacy as defined in article 45(2) of Regulation (EU) 2016/679, and provide European citizens with assurance that it would repeal the adequacy decision if these proposals were to become law.
The DPDI Bill would give the UK government the power to override data protection principles whenever it sees fit
European personal data could be accessed by UK public authorities without basic human rights safeguards in place, thanks to new delegated legislative powers which would allow UK Ministers to override the law arbitrarily and without meaningful boundaries to their discretion.
At the same time, the Bill would undermine the independence of the UK data protection supervisory authority by establishing a new Information Commission, whose board would be directly appointed by the UK Government. Ministers would have the power to dictate strategic priorities to the Information Commission, and to interfere with the exercise of its powers.
The DPDI Bill would facilitate the onward sharing of European personal data to third countries without safeguards
The Bill would weaken the definition of personal data below the standards set by the 1981 Council of Europe Convention 108 on data protection. In turn, organisations could use the UK as a base to pseudonymise European personal data before transferring them to third countries: this data would be considered anonymous by UK data protection law, and safeguards afforded to personal data would not apply.
Further, the Bill would allow the UK Government to authorise personal data transfers to third countries in the absence of meaningful Parliamentary scrutiny, and without guarantees concerning the retention of enforceable rights and effective remedies once this data has been transferred. Indeed, the UK has already applied for associate membership of the US-backed Cross-Border Privacy Rules Forum, which enables international data transfers under the weaker APEC privacy framework.
UK public authorities have been showing growing disregard toward ECHR standards, which are an essential element of the UK adequacy decision
The UK is enacting a wave of illiberal legislation that has been described by Human Rights Watch as “the most significant assault on human rights protections in the UK in decades”, including restrictions to the right to protest and to strike. The UK Government is also seeking powers to legislate without parliamentary oversight, to overrule judgments from the European Court of Human Rights, to deport migrants without a fair trial or due process, and to remove modern slavery protections for trafficking survivors.
The UK Data Protection Reform follows this trend: 30 domestic civil society organisations accused the UK Government of ignoring critical voices in a rigged consultation process, and later denounced the undemocratic nature of the Bill.
The Commission must act
In light of the serious threat to European citizens’ rights, the European Commission must publicly acknowledge that conditions which underpinned the UK adequacy decision are about to change: the undersigned organisations call on the Commission to stand ready to adopt immediately applicable implementing acts to repeal the UK adequacy Decision, in accordance with the procedure referred to in Article 93(3) of Regulation (EU) 2016/679.
Your sincerely,
Ian Brown, Internet regulation expert
Prof. Dr. J.V.J. van Hoboken, Associate Professor, Institute for Information Law (IViR), Faculty of Law, University of Amsterdam, Professor of Law, LSTS, Vrije Universiteit Brussel
Douwe Korff, Emeritus Professor of International Law, London Metropolitan University
Max Schrems, Honorary Chairman, noyb
Access Now
AI Forensics
Amnesty International
Article 19
Big Brother Watch
Defend Democracy
Digitalcourage
Državljan D / Citizen D
Ekō
Electronic Frontier Norway
Epicenter.works
Eticas
European Digital Rights Initiative
Fair Vote UK
Foxglove
Fitug e.V.
Irish Council of Civil Liberties
IT-Pol Denmark
Open Rights Group
Panoptykon
Privacy International
The London Story
WeMove Europe
#jesuislà