Data flows post-Brexit: 'Leave it to government to make sure you've got a smooth run in.' Er, OK
Brexitary Dominic Raab bullish about adequacy – because everything's going sooo well
Brexit secretary Dominic Raab has claimed businesses need to do "very little" to ensure data flows after March – despite official advice that they should start drafting new contracts in case of no deal Brexit.
Speaking at a Town Hall Q&A event about Brexit and the tech industry last night in London, Raab repeatedly emphasised the importance of continued data exchange following the UK's split from the EU, returning to that topic more than any other.
He argued the UK had "grounds for agreement" with the European Union on data protection, and these provisions "mean that businesses will not really need to do very much at all".
UK.gov tells companies to draft contracts for data flows just in case they screw up BrexitREAD MORE
He claimed: "You can leave it to government to make sure you've got a smooth run in."
Raab's argument is based on the notion that the UK will easily gain an adequacy decision from the EU, which states the UK's data protection laws meet EU standards. But this isn't a foregone conclusion.
Adequacy negotiations can take about two years. At the moment, the implementation period ends on 31 December 2020 – beyond that there is a risk of the UK slipping off a data cliff edge.
When making its decision, the EU will also have to take into account both the UK's intrusive surveillance laws, and exemptions it made when transferring GDPR into UK law.
All the while, the matter of a deal is not set in stone, despite recent noises that one is imminent. If Britain was to leave the bloc without one, there will be no buffer.
This means businesses will have to rely on other means for data transfer, most likely standard contractural clauses, which the government advised companies to prepare for in its technical notice on data protection.
But when challenged on these points – and whether business can simply sit back and leave it to the government, when there remains a lot of uncertainty and the possibility firms will need new contracts – Raab remained bullish.
"In a deal scenario... there will be plenty of time in the implementation period and we're pretty confident of getting an adequacy decision at the end of that as we're starting from a point of alignment," he said in response to a question from The Register.
Raab also seemed loath to admit that companies might need to prepare new contracts sooner rather than later – despite the fact negotiating hundreds, or possibly thousands, of new contracts with EU partners could take businesses many months.
He maintained that if the UK crashed out without a deal, negotiating an adequacy decision would still "move very swiftly", but failed to acknowledge that companies would still have to set up contracts for the interim period.
Rather, he focused on the idea that having to use contracts would be in a situation where "politics trumped the common-sense approach to what is in both sides' interest" – which will no doubt be the party line if adequacy is not achieved.
Beyond that assertion, he did what politicians do best, and remained vague – which is unlikely to engender much confidence within businesses that are desperate for clarity and certainty.
UK and EU crawling towards post-Brexit data exchange deal – reportsREAD MORE
"Obviously, in a no-deal scenario we'll have to think about that more carefully," he told El Reg. "We will be providing more information as and when that becomes a live issue."
And even if Raab is right and the EU grants the UK an adequacy deal at record speed, the nation must ensure its laws stay in line with EU ones. But Raab, the Brexiteer, suggested the UK might want to deviate from them, saying he is "not sure the EU is the world-leading protector of data".
"I think that a lot of businesses have concerns about the balance they've struck with GDPR," he added.
"We would start from a position of alignment [and] we would have the opportunity in the future, over time, to depart. But precisely because of the importance of retaining an adequacy decision, we would want to make sure that we had equivalent levels of data protection."
Such comments risk reigniting criticisms that the UK is complacent about the data protection negotiations it will soon be entering with the EU; the bloc will want assurances the UK is going to toe the line, rather than vague references to departure.
Elsewhere, Raab moved to reassure businesses the UK is pushing for frictionless trade at the border for just-in-time businesses and to ensure there were no shortages after Brexit.
He also emphasised the UK would remain open to immigration from across the world, after people expressed concerns about recruiting talent from overseas or cases where developers were already leaving firms. The much-anticipated white paper on immigration is due "reasonably soon", he said. ®
Sponsored: Becoming a Pragmatic Security Leader