'Brexit' Could Put Data Sharing in Jeopardy

A combination of a vote to leave and the passing of the so-called 'snoopers' charter' could see a ban on the transfer of data between the UK and EU, with a severe economic impact.

Last week, the European Commission published the text of the new Privacy Shield, which will govern the lawful transfer of data between the EU and US following the abolition of the previous data sharing agreement, Safe Harbour, by a ruling of the European Court of Justice (ECJ). A few days later, the UK government published an updated version of the Investigatory Powers Bill (the so-called ‘snoopers’ charter’) for presentation to parliament.

Privacy Shield covers the obligations of non-EU commercial organizations and governments when handling data of EU citizens. The Investigatory Powers Bill will regulate the role of security services and police in the UK for UK citizens’ data. Should Britain vote to leave the EU in the forthcoming referendum, the interplay of between these two could be devastating for UK digital industries.

Legislation at odds

Privacy advocates have derided Privacy Shield as gutless, but weak as it may be, the draft adequacy decision goes out of its way to emphasize how limited bulk data collection will be: ‘limited to (exceptional) situations where targeted collection is not possible’. The document repeatedly states that targeted collection will be preferred over bulk, and that collection will be ‘narrowly focused’ relating to ‘individually identified legitimate targets’.

In contrast, despite the recommendations of the three committees tasked to review it, the Investigatory Powers Bill published last week retains highly controversial proposals for bulk collection, bulk interception and equipment interference. The draft bill provides for no preference for targeted surveillance over bulk collection, it does not limit bulk collection or access to situations where it is strictly necessary, or where there is no alternative. 

Yes, the draft bill provides for strengthened oversight compared to the situation now, but by vesting the power to issue warrants in the home secretary rather than judges, the bill risks falling foul of the European Court of Human Rights’ ruling that such ‘eminently political’ supervision ‘is inherently incapable’ of providing the necessary guarantees and safeguards for human rights.

Low leverage

There was a strong mutual interest for the EU and US to move quickly to restore lawful cross border data sharing after Safe Harbour was invalidated. Like the rest of the world, EU citizens are highly reliant on US web platforms. In nearly every EU country, the top three most visited websites are American: Google, Facebook and YouTube. Stopping transatlantic data flows would severely affect the lives of European citizens. It would also have a major financial impact on US companies locked out of the largest economic bloc in the world.

Although digital industries represent 10 per cent of Britain’s GDP, the highest percentage of any G20 member, the EU is far less reliant on the UK’s digital exports than on big US tech companies. But if data flows between Britain and the EU are impeded, it will adversely affect British economic interests − e-commerce was valued at 20 per cent of British business turnover in 2014 according to the Office for National Statistics.

Plus, data sharing has an impact on all business with the EU (both online and offline), valued at 45 per cent of UK exports and 53 per cent of UK imports. New data protection regulations will guarantee EU citizens the same level of protection wherever their data is processed. Order books, sales and purchase records all involve the processing of personal data.

Trouble ahead

Should the British vote to leave, data transfer would no doubt form part of lengthy negotiations covering all aspects of the UK’s relationship with the EU. Meanwhile, the market would move without waiting for the politicians. When the ECJ abolished Safe Harbour, large (US) cloud providers quickly began offering guaranteed hosting in the EU, long before Privacy Shield was agreed.

During the uncertain period following the referendum, international providers are likely to move data out of the UK in a similar way. Meanwhile UK companies, rather than enjoying a reduction in Brussels red tape after Brexit, would still be bound by EU regulations when handling the data of EU citizens, as well as facing barriers to data transfer.

This is unlikely to be a temporary problem. The reason why the ECJ ruled Safe Harbour invalid was because of US practices of mass data retention and sharing with law enforcement, as exposed by Edward Snowden. The so-called ‘snooper’s charter’ proposes to enshrine in law equivalent practices, plus more intrusive powers to inspect internet connection records. 

If it becomes law, a post-Brexit UK would be unlikely to meet the standards required for Privacy Shield status. This would prohibit cross border data transfers between UK and EU. Even if there is some cobbled together agreement, Britain may find its former EU partners less willing to jump to the negotiating table to rescue UK economic interests. British business would continue to face barriers, and British citizens would end up with fewer protections than EU citizens against UK government intrusion.

Chatham House:http://ow.ly/Zyr7M

Emily Taylor is an internet governance expert and an associate fellow of Chatham House 

« Directors & Senior Management Cyber Report (£)
Now Surveillance 'aggressive-invasive': Snowden »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

CloudDNA

CloudDNA

CloudDNA deliver solutions that enable users and devices to connect over high performance, secure, efficient, scalable cloud networks.

Cristie Data

Cristie Data

Cristie have been a trusted, innovative and leading edge data storage, backup and virtualisation solutions provider across all sectors of industry for over 40 years.

Intruder

Intruder

Intruder is a cloud-based vulnerability scanner that finds cyber security weaknesses in your digital infrastructure, to avoid costly data breaches.

Cyber Security Recruiters

Cyber Security Recruiters

Cyber Security Recruiters is a niche recruiting firm who finds impact players for our clients in the Information Security Space.

CloudLayar

CloudLayar

CloudLayar is a cloud-based website firewall for protecting your website against online threats.

Wavestone

Wavestone

Wavestone is a strategy and technology consulting company with areas of expertise including digital transformation and cybersecurity.

CyberDefcon

CyberDefcon

CyberDefcon is an independent organization dedicated to the pursuit of making the internet a safer place.

PrimeKey

PrimeKey

PrimeKey provides organisations with the ability to implement security solutions such as e-ID, e-Passports, authentication, digital signatures, unified digital identities and validation.

Sysmosoft

Sysmosoft

Sysmosoft specializes in providing highly secured telecommunication solutions for mobile devices for companies requiring protected access to sensitive data remotely.

Cybersecurity Innovation Hub

Cybersecurity Innovation Hub

The main objective of the Hub is to bring cybersecurity and other advanced technologies closer to companies and as a result help to increase their performance as Industry 4.0.

ODSC

ODSC

ODSC is a security systems integrator that provides services and expertise in identity management and access.

C5 Capital

C5 Capital

C5 Capital is a specialist investment firm that exclusively invests in the secure data ecosystem including cybersecurity, cloud infrastructure, data analytics and space.

Auriga Consulting

Auriga Consulting

Auriga is a center of excellence in Cyber Security, Assurance and Monitoring Services, with a renowned track record of succeeding where others have failed.

Redpoint Security

Redpoint Security

Redpoint Security is an application security consulting firm that is focused on all aspects of code security.

Silent Circle

Silent Circle

Silent Circle is the leader in end-to-end enterprise solutions for secure mobile communications.

Continent 8 Technologies

Continent 8 Technologies

Continent 8 Technologies is the leading provider of managed hosting, connectivity, cloud and cybersecurity solutions to the global online gambling industry.