Data protection and the future EU-UK relationship

This week the EU and the UK set out their formal opening positions on the future EU-UK relationship. The UK's position contains a number of goals:

• adopting an independent policy on data protection at the end of the transition period
• keeping high data protection standards
• negotiating an EU adequacy decision for the UK by the end of the transition period
• keeping the adequacy negotiations separate from the negotiations on the future relationship
• developing new international transfers mechanisms
• assessing the EEA and other countries under the new international transfers mechanisms (presumably with a view to conferring some kind of "UK adequacy decisions")
• establishing "appropriate arrangements" to allow "continued cooperation between the ICO and the EU member states' data protection authorities"
• establishing a framework for dialogue between the ICO and EU member state data protection authorities.

 
The EU's position is more high-level.  It emphasises the following:

• the importance of data flows
• the need for the "envisaged partnership" to affirm both sides' commitment to ensuring high levels of data protection and to fully respect the EU's decision-making process as regards adequacy
• the need for adequacy (if the applicable conditions are met) in order to foster cooperation, exchange of information and as a condition of achieving cooperation in the context of law enforcement and judicial cooperation.

 
Comment 
The EU appears to be signalling that it won't be rushed on an adequacy decision for the UK, but that it recognises the importance of the principle of the free flow of data.  Time will tell whether the remaining months are sufficient for an adequacy decision to be reached (the UK wants the adequacy decision to be adopted by 31^st December 2020).
Although both sides are committed to high standards of data protection, the UK is keen to point out that its policy on data protection is "independent".  In reality the EU is likely to require the UK to align its standards with the GDPR.  The negotiations on adequacy will have to be on the basis of the UK's plan to turn the GDPR into a "UK GDPR" at the end of the transition period because there is no time for the UK to come up with a new regime, negotiate adequacy on the basis of that regime and meet the deadline of 31^st December 2020. 
The UK's intention to develop its own international transfers regime is reaffirmed.  It is unclear what that regime will look like, but it appears that the UK will develop its own scheme for assessing the adequacy of other countries' data protection regimes.  How quickly those assessments can be undertaken is an open question.  If they are to be as detailed as the EU's adequacy process they will take time to complete.  
The EU is much vaguer than the UK about regulatory cooperation.  The language in the political declaration on the future relationship about making arrangements for cooperation has been replaced by an emphasis on the need for adequacy as a prerequisite for coordinating on regulatory action.
The UK's emphasis on the fact that the negotiations on adequacy are separate from the main negotiations on the future relationship is interesting.   The EU appears to take a different position on this point.  It says that the "envisaged partnership" (ie the  future EU-UK trade deal) should affirm commitments to high data protection standards.  This means that data protection is part of the politics of the wider negotiations.  The dynamic of those wider negotiations could therefore influence what happens on adequacy.
Conclusion
There are no surprises here on either side.  The longstanding plan in relation to EU adequacy for the UK remains.  Adequacy is clearly going to be key to ensuring cooperation between regulators:  a highly desirable outcome given the high volumes of data transferred between the UK and the EU and the need for coordination. 
The main challenges are timing and political headwinds.  On timing, no country has ever secured an EU adequacy decision within the timeframes envisaged here.  On the politics of the wider negotiations, the EU is currently asserting that the UK Government has gone back on the position agreed in the political declaration on the future relationship as regards alignment of standards on areas such as workers' rights, the environment and state aid.  That suggests that the wider negotiations will be tough and potentially acrimonious.
Although the UK has emphasised that the negotiations on EU adequacy for the UK are separate from the main negotiations on the future trading arrangements, the EU sees data protection and the wider negotiations as intertwined.  That means that disagreements in the wider negotiations could have an impact on the negotiations on adequacy.  The phrase most frequently heard in Brussels is "nothing is agreed until everything is agreed".