Open Letter to the EU Commission regarding UK’s data bill
Executive Vice-President Vera Jourova
Commissioner Didier Reynders
Rue de la Loi 2001049 Brussels
Belgium
Cc
Bruno Gencarelli, Head of International Data Flows, DG Just
Re: Reassessment of UK adequacy decision in light of dangerous UK data bill
Dear Executive Vice President Jourova,
Dear Commissioner Reynders,
The undersigned organisations and individuals are deeply concerned about the UK government’s Data Protection and Digital Information (DPDI) Bill, which would turn the UK into a “leaky valve” that undermines the data protection rights of European citizens.
In June 2021, an adequacy decision was granted to the UK allowing the free flow of personal data to and from the United Kingdom without additional safeguards. This decision, granted by the Commission, rested on the premise that the UK's data protection system would continue to follow the same rules as when the UK was an EU Member State.
The DPDI Bill flies in the face of the 2021 adequacy decision. If passed, the Bill would mean a wholesale deregulation of the UK data protection framework, allowing private companies to seek shelter in the UK to circumvent European data protection standards, and turning the UK into a “test lab” for experimental and abusive uses of data. Likewise, the UK Government would be given the power to legalise invasive surveillance programmes and other measures that trump the right to data protection of European citizens.
The Commission must urgently take stock of these changes, which directly contradict key elements of data protection adequacy as defined in article 45(2) of Regulation (EU) 2016/679, and provide European citizens with assurance that it would repeal the adequacy decision if these proposals were to become law.
The DPDI Bill would give the UK government the power to override data protection principles whenever it sees fit
European personal data could be accessed by UK public authorities without basic human rights safeguards in place, thanks to new delegated legislative powers which would allow UK Ministers to override the law arbitrarily and without meaningful boundaries to their discretion.
At the same time, the Bill would undermine the independence of the UK data protection supervisory authority by establishing a new Information Commission, whose board would be directly appointed by the UK Government. Ministers would have the power to dictate strategic priorities to the Information Commission, and to interfere with the exercise of its powers.
The DPDI Bill would facilitate the onward sharing of European personal data to third countries without safeguards
The Bill would weaken the definition of personal data below the standards set by the 1981 Council of Europe Convention 108 on data protection. In turn, organisations could use the UK as a base to pseudonymise European personal data before transferring them to third countries: this data would be considered anonymous by UK data protection law, and safeguards afforded to personal data would not apply.
Further, the Bill would allow the UK Government to authorise personal data transfers to third countries in the absence of meaningful Parliamentary scrutiny, and without guarantees concerning the retention of enforceable rights and effective remedies once this data has been transferred. Indeed, the UK has already applied for associate membership of the US-backed Cross-Border Privacy Rules Forum, which enables international data transfers under the weaker APEC privacy framework.
UK public authorities have been showing growing disregard toward ECHR standards, which are an essential element of the UK adequacy decision
The UK is enacting a wave of illiberal legislation that has been described by Human Rights Watch as “the most significant assault on human rights protections in the UK in decades”, including restrictions to the right to protest and to strike. The UK Government is also seeking powers to legislate without parliamentary oversight, to overrule judgments from the European Court of Human Rights, to deport migrants without a fair trial or due process, and to remove modern slavery protections for trafficking survivors.
The UK Data Protection Reform follows this trend: 30 domestic civil society organisations accused the UK Government of ignoring critical voices in a rigged consultation process, and later denounced the undemocratic nature of the Bill.
The Commission must act
In light of the serious threat to European citizens’ rights, the European Commission must publicly acknowledge that conditions which underpinned the UK adequacy decision are about to change: the undersigned organisations call on the Commission to stand ready to adopt immediately applicable implementing acts to repeal the UK adequacy Decision, in accordance with the procedure referred to in Article 93(3) of Regulation (EU) 2016/679.
Your sincerely,
Ian Brown, Internet regulation expert
Prof. Dr. J.V.J. van Hoboken, Associate Professor, Institute for Information Law (IViR), Faculty of Law, University of Amsterdam, Professor of Law, LSTS, Vrije Universiteit Brussel
Douwe Korff, Emeritus Professor of International Law, London Metropolitan University
Max Schrems, Honorary Chairman, noyb
Access Now
AI Forensics
Amnesty International
Article 19
Big Brother Watch
Defend Democracy
Digitalcourage
Državljan D / Citizen D
Ekō
Electronic Frontier Norway
Epicenter.works
Eticas
European Digital Rights Initiative
Fair Vote UK
Foxglove
Fitug e.V.
Irish Council of Civil Liberties
IT-Pol Denmark
Open Rights Group
Panoptykon
Privacy International
The London Story
WeMove Europe
#jesuislà
Related Articles
LGBTQ+ groups tell Leo Varadkar: reform the Irish Data Protection Commission
Dozens of LGBTQ+ and human rights groups have written to Irish Taoiseach Leo Varadkar asking him to reform the Irish Data Protection Commission
EU citizens’ data and privacy rights at serious risk
As the Court of Justice of the European Union decides a crucial question, a statement from civil society outlines what’s at stake
Vast Majority of French People Do Not Want to be Targeted with Online Ads Based on Their Sensitive Personal Data (YouGov Poll)
New polling reveals 70% of adults in France support a ban on the use of people’s sensitive personal data in online targeted advertising
Most Read
Letter to European Commissioner Breton: Tackling harmful recommender systems
Civil society organisations unite behind Coimisiún na Meán’s proposal to disable profiling-based recommender systems on social media video platforms
Prototyping User Empowerment – Towards DSA-compliant recommender systems
What would a healthy social network look like? Researchers, civil society experts, technologists and designers came together to imagine a new way forward
ESC Big Tech this Black Friday
People vs Big Tech has joined forces with high street brand Lush to raise money for our work to rein in the harmful power of the Big Tech corporations