'Brexit' Could Put Data Sharing in Jeopardy

A combination of a vote to leave and the passing of the so-called 'snoopers' charter' could see a ban on the transfer of data between the UK and EU, with a severe economic impact.

Last week, the European Commission published the text of the new Privacy Shield, which will govern the lawful transfer of data between the EU and US following the abolition of the previous data sharing agreement, Safe Harbour, by a ruling of the European Court of Justice (ECJ). A few days later, the UK government published an updated version of the Investigatory Powers Bill (the so-called ‘snoopers’ charter’) for presentation to parliament.

Privacy Shield covers the obligations of non-EU commercial organizations and governments when handling data of EU citizens. The Investigatory Powers Bill will regulate the role of security services and police in the UK for UK citizens’ data. Should Britain vote to leave the EU in the forthcoming referendum, the interplay of between these two could be devastating for UK digital industries.

Legislation at odds

Privacy advocates have derided Privacy Shield as gutless, but weak as it may be, the draft adequacy decision goes out of its way to emphasize how limited bulk data collection will be: ‘limited to (exceptional) situations where targeted collection is not possible’. The document repeatedly states that targeted collection will be preferred over bulk, and that collection will be ‘narrowly focused’ relating to ‘individually identified legitimate targets’.

In contrast, despite the recommendations of the three committees tasked to review it, the Investigatory Powers Bill published last week retains highly controversial proposals for bulk collection, bulk interception and equipment interference. The draft bill provides for no preference for targeted surveillance over bulk collection, it does not limit bulk collection or access to situations where it is strictly necessary, or where there is no alternative. 

Yes, the draft bill provides for strengthened oversight compared to the situation now, but by vesting the power to issue warrants in the home secretary rather than judges, the bill risks falling foul of the European Court of Human Rights’ ruling that such ‘eminently political’ supervision ‘is inherently incapable’ of providing the necessary guarantees and safeguards for human rights.

Low leverage

There was a strong mutual interest for the EU and US to move quickly to restore lawful cross border data sharing after Safe Harbour was invalidated. Like the rest of the world, EU citizens are highly reliant on US web platforms. In nearly every EU country, the top three most visited websites are American: Google, Facebook and YouTube. Stopping transatlantic data flows would severely affect the lives of European citizens. It would also have a major financial impact on US companies locked out of the largest economic bloc in the world.

Although digital industries represent 10 per cent of Britain’s GDP, the highest percentage of any G20 member, the EU is far less reliant on the UK’s digital exports than on big US tech companies. But if data flows between Britain and the EU are impeded, it will adversely affect British economic interests − e-commerce was valued at 20 per cent of British business turnover in 2014 according to the Office for National Statistics.

Plus, data sharing has an impact on all business with the EU (both online and offline), valued at 45 per cent of UK exports and 53 per cent of UK imports. New data protection regulations will guarantee EU citizens the same level of protection wherever their data is processed. Order books, sales and purchase records all involve the processing of personal data.

Trouble ahead

Should the British vote to leave, data transfer would no doubt form part of lengthy negotiations covering all aspects of the UK’s relationship with the EU. Meanwhile, the market would move without waiting for the politicians. When the ECJ abolished Safe Harbour, large (US) cloud providers quickly began offering guaranteed hosting in the EU, long before Privacy Shield was agreed.

During the uncertain period following the referendum, international providers are likely to move data out of the UK in a similar way. Meanwhile UK companies, rather than enjoying a reduction in Brussels red tape after Brexit, would still be bound by EU regulations when handling the data of EU citizens, as well as facing barriers to data transfer.

This is unlikely to be a temporary problem. The reason why the ECJ ruled Safe Harbour invalid was because of US practices of mass data retention and sharing with law enforcement, as exposed by Edward Snowden. The so-called ‘snooper’s charter’ proposes to enshrine in law equivalent practices, plus more intrusive powers to inspect internet connection records. 

If it becomes law, a post-Brexit UK would be unlikely to meet the standards required for Privacy Shield status. This would prohibit cross border data transfers between UK and EU. Even if there is some cobbled together agreement, Britain may find its former EU partners less willing to jump to the negotiating table to rescue UK economic interests. British business would continue to face barriers, and British citizens would end up with fewer protections than EU citizens against UK government intrusion.

Chatham House:http://ow.ly/Zyr7M

Emily Taylor is an internet governance expert and an associate fellow of Chatham House 

« Directors & Senior Management Cyber Report (£)
Now Surveillance 'aggressive-invasive': Snowden »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

AVR International

AVR International

AVR educate, advise, analyse and provide professional, technical consultancy and support to ensure your business is safe, compliant and protected.

Swedish Civil Contingencies Agency (MSB)

Swedish Civil Contingencies Agency (MSB)

MSB's Information Assurance Department is responsible for supporting and coordinating work relating to Sweden's national societal information security.

Crosscheck Networks

Crosscheck Networks

Crosscheck products allow you to test your APIs across different protocols and message formats with functional automation, performance, and security testing capabilities.

Dell Technologies

Dell Technologies

Dell Technologies Consulting Services enables a highly resilient business amidst the proliferation of cloud-based IT services and constant threats to your most critical information.

ePlus

ePlus

ePlus designs and delivers effective, integrated cybersecurity programs centered on culture and technology, aimed at mitigating business risk and empowering digital transformation.

Cyemptive Technologies

Cyemptive Technologies

Cyemptive's CyberSlice technology preempts and remove threats before they take hold, in seconds, compared to other’s hours, days, weeks and even months.

LogicHub

LogicHub

LogicHub is built on the principle that every decision process for threat detection and response can and should be automated.

INFRA Security & Vulnerability Scanner

INFRA Security & Vulnerability Scanner

INFRA is a powerful platform with an easy interface for any kind of Ethical Hacking, from corporate monitoring and VAPT (vulnerability assessments and penetration testing) to military intelligence.

Littlefish

Littlefish

Littlefish provide world-class, award-winning Managed IT and Cyber Security Services, delivered from our 24/7 UK service centres.

CleanCloud by SEK

CleanCloud by SEK

CleanCloud by SEK is a CSPM product focused on public cloud data protection and security regulations, with over 400 compliance checks for the market's leading frameworks and regulations.

AML Global Solutions (AMLGS)

AML Global Solutions (AMLGS)

AMLGS delivers Financial Crime prevention training programmes and consultancy services encompassing Anti-Money Laundering (AML), Counter Terrorism Financing (CTF), Bribery & Corruption and Fraud.

Etisalat and (e&)

Etisalat and (e&)

Etisalat Group is one of the world’s leading telecom groups in emerging markets.

Venari Security

Venari Security

Venari is an award-winning cybersecurity SaaS provider that has developed an ETA (Encrypted Traffic Analysis) platform which fundamentally changes the way encrypted traffic is analysed.

Castlepoint Systems

Castlepoint Systems

Castlepoint Systems is a pioneer in information governance, risk and compliance as a service. An all-in-one solution offering powerful risk management, built in compliance, cybersecurity and audit.

Sri Lanka CERT

Sri Lanka CERT

Sri Lanka CERT is the National Centre for Cyber Security, which has the national responsibility of protecting the nation’s cyberspace from cyber threats.

OxCyber

OxCyber

OxCyber's mission is to ignite and encourage cybersecurity and technology growth in the Thames Valley through meetings, webinars, in person events, workshops and mentorship programs.