The UK government has announced it has opened up new dialogue with the US over data flows and technology collaboration, following last week’s decision to replace the General Data Protection Regulation (GDPR) with new UK-specific data laws.
UK digital secretary Michelle Donelan and US secretary of commerce Gina Raimondo issued a joint statement stating that the two countries are close to agreeing a data adequacy agreement, which would allow data to flow more freely between the two countries. The two also committed to a new official dialogue, an annual meeting which will bring together senior officials from across both governments to progress shared tech priorities and deliver joint initiatives. The first meeting will focus on data, critical and emerging technologies, and resilient digital infrastructure.
The news is positive for the digital advertising industry, given the volumes of personal data which are transferred between borders by advertising businesses. But it also demonstrates the challenges ahead for the UK’s new data privacy strategy, as it seeks to design its own laws while maintaining cross-border data flows.
Extra homework
‘Data adequacy’ is a general term used when comparing different markets’ data protection laws.
Given how frequently data moves between borders, any country or political body’s data laws are only really effective if data protections can be upheld when that data is sent abroad, as well as when it’s kept within that country’s own borders.
In some cases, laws will dictate that businesses have to sign particular agreements before sending data overseas, which guarantee that the data in question will be protected abroad as well as at home. But to cut out this administrative burden, one market might decide that another market’s data laws are at least equal to its own, in terms of the protections afforded to personal data. When that’s the case, that market is granted ‘data adequacy’, meaning those data transfer agreements can be dropped.
Data adequacy has been a big topic in recent years for several reasons. A series of legal rulings have determined that mechanisms set up between the US and EU to allow free data transfers are invalid, placing extra burdens on businesses and threatening to shut down Meta and Google Analytics’ operations in Europe entirely. And after the UK left the EU, data adequacy had to be established to ensure that data could continue to flow freely between the EU and UK, even though GDPR is enshrined in UK law.
The latter has now been resolved, but the former has remained an open issue, though progress has been made. US president Joe Biden signed an executive order on Friday, which seeks to resolve one of the main tensions which has hindered progress towards an agreement (namely, the fact that the US government can demand access to personal data in certain circumstances, which runs contrary to GDPR).
This same executive order should smooth the path for the UK to agree a data adequacy agreement with the US, which again would cut down a lot of administrative work for media companies and advertising businesses which send data between the two countries.
But it’s also a reminder of all the work which lies ahead for the UK if it goes ahead with scrapping GDPR and writing its own data privacy laws. The importance of cross-border data flows means that each individual country’s data laws don’t exist in a vacuum. Once new laws come into effect, the UK will once again have to put in the groundwork to prove data adequacy with foreign markets, or to come up with mechanisms to allow free data transfers in the absence of data adequacy. And if the UK significantly liberalises its data privacy laws, there’s a very real chance the UK may not be granted data adequacy status by other major markets, namely the EU.
If this is the case, all the administrative work which the UK is seeking to cut out for UK-US data transfers, may be reintroduced for UK-EU data transfers.
