'Brexit' Could Put Data Sharing in Jeopardy

A combination of a vote to leave and the passing of the so-called 'snoopers' charter' could see a ban on the transfer of data between the UK and EU, with a severe economic impact.

Last week, the European Commission published the text of the new Privacy Shield, which will govern the lawful transfer of data between the EU and US following the abolition of the previous data sharing agreement, Safe Harbour, by a ruling of the European Court of Justice (ECJ). A few days later, the UK government published an updated version of the Investigatory Powers Bill (the so-called ‘snoopers’ charter’) for presentation to parliament.

Privacy Shield covers the obligations of non-EU commercial organizations and governments when handling data of EU citizens. The Investigatory Powers Bill will regulate the role of security services and police in the UK for UK citizens’ data. Should Britain vote to leave the EU in the forthcoming referendum, the interplay of between these two could be devastating for UK digital industries.

Legislation at odds

Privacy advocates have derided Privacy Shield as gutless, but weak as it may be, the draft adequacy decision goes out of its way to emphasize how limited bulk data collection will be: ‘limited to (exceptional) situations where targeted collection is not possible’. The document repeatedly states that targeted collection will be preferred over bulk, and that collection will be ‘narrowly focused’ relating to ‘individually identified legitimate targets’.

In contrast, despite the recommendations of the three committees tasked to review it, the Investigatory Powers Bill published last week retains highly controversial proposals for bulk collection, bulk interception and equipment interference. The draft bill provides for no preference for targeted surveillance over bulk collection, it does not limit bulk collection or access to situations where it is strictly necessary, or where there is no alternative. 

Yes, the draft bill provides for strengthened oversight compared to the situation now, but by vesting the power to issue warrants in the home secretary rather than judges, the bill risks falling foul of the European Court of Human Rights’ ruling that such ‘eminently political’ supervision ‘is inherently incapable’ of providing the necessary guarantees and safeguards for human rights.

Low leverage

There was a strong mutual interest for the EU and US to move quickly to restore lawful cross border data sharing after Safe Harbour was invalidated. Like the rest of the world, EU citizens are highly reliant on US web platforms. In nearly every EU country, the top three most visited websites are American: Google, Facebook and YouTube. Stopping transatlantic data flows would severely affect the lives of European citizens. It would also have a major financial impact on US companies locked out of the largest economic bloc in the world.

Although digital industries represent 10 per cent of Britain’s GDP, the highest percentage of any G20 member, the EU is far less reliant on the UK’s digital exports than on big US tech companies. But if data flows between Britain and the EU are impeded, it will adversely affect British economic interests − e-commerce was valued at 20 per cent of British business turnover in 2014 according to the Office for National Statistics.

Plus, data sharing has an impact on all business with the EU (both online and offline), valued at 45 per cent of UK exports and 53 per cent of UK imports. New data protection regulations will guarantee EU citizens the same level of protection wherever their data is processed. Order books, sales and purchase records all involve the processing of personal data.

Trouble ahead

Should the British vote to leave, data transfer would no doubt form part of lengthy negotiations covering all aspects of the UK’s relationship with the EU. Meanwhile, the market would move without waiting for the politicians. When the ECJ abolished Safe Harbour, large (US) cloud providers quickly began offering guaranteed hosting in the EU, long before Privacy Shield was agreed.

During the uncertain period following the referendum, international providers are likely to move data out of the UK in a similar way. Meanwhile UK companies, rather than enjoying a reduction in Brussels red tape after Brexit, would still be bound by EU regulations when handling the data of EU citizens, as well as facing barriers to data transfer.

This is unlikely to be a temporary problem. The reason why the ECJ ruled Safe Harbour invalid was because of US practices of mass data retention and sharing with law enforcement, as exposed by Edward Snowden. The so-called ‘snooper’s charter’ proposes to enshrine in law equivalent practices, plus more intrusive powers to inspect internet connection records. 

If it becomes law, a post-Brexit UK would be unlikely to meet the standards required for Privacy Shield status. This would prohibit cross border data transfers between UK and EU. Even if there is some cobbled together agreement, Britain may find its former EU partners less willing to jump to the negotiating table to rescue UK economic interests. British business would continue to face barriers, and British citizens would end up with fewer protections than EU citizens against UK government intrusion.

Chatham House:http://ow.ly/Zyr7M

Emily Taylor is an internet governance expert and an associate fellow of Chatham House 

« Directors & Senior Management Cyber Report (£)
Now Surveillance 'aggressive-invasive': Snowden »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

National Crime Agency (NCA)

National Crime Agency (NCA)

The NCA's Cyber Crime Unit focuses on critical cyber incidents in the UK as well as longer-term activity against the criminals and the services on which they depend.

Technology Association of Georgia (TAG)

Technology Association of Georgia (TAG)

TAG's mission is to educate, promote, influence and unite Georgia's technology community to stimulate and enhance Georgia's tech-based economy.

IPCopper

IPCopper

IPCopper specializes in network packet capture appliances for cybersecurity, cybersurveillance and network monitoring, and encrypted data storage.

Cyber Security For Critical Manufacturing (ManuSec)

Cyber Security For Critical Manufacturing (ManuSec)

Cyber Security For Critical Manufacturing (Manusec) is a global series of summits focusing on Cyber Security for Critical Manufacturing Sectors.

ComTrue Technologies

ComTrue Technologies

ComTrue Technologies provides artificial intelligence solutions and information security solutions.

Decision Group

Decision Group

Decision Group are a Total Solution Supplier offering Network Forensics and Lawful Interception tools.

Riverside Research

Riverside Research

Riverside Research is a not-for-profit organization chartered to advance scientific research in areas including Trusted & Resilient Systems.

US Secret Service

US Secret Service

The US Secret Service has a pivotal role in securing the nation’s critical infrastructures, specifically in the areas of cyber, banking and finance.

Appgate

Appgate

Appgate is the secure access company. We empower how people work and connect by providing solutions purpose-built on Zero Trust security principles.

Cyber Security Canada

Cyber Security Canada

Cyber Security Canada is an accredited Certification Body for government-backed Cyber Security Certification Programs, designed specifically for small and medium-sized Canadian businesses.

6clicks

6clicks

6clicks is an easy way to implement your risk and compliance program or achieve compliance with ISO 27001, SOC 2, PCI-DSS, HIPAA, NIST, FedRAMP and many other standards.

Fortiedge

Fortiedge

Fortiedge is an IT Security solution provider specializing in Cyber Security practices and solutions for our clients.

Interactive

Interactive

Interactive are a leading Australian IT service provider with services in Cloud, Cyber Security, Data Centres, Business Continuity, Hardware Maintenance, Digital Workplace, and Networks.

Databarracks

Databarracks

Databarracks deliver award winning IT resilience and continuity services. We help organisations get the most out of the cloud and protect their data, wherever it lives.

Resonance Security

Resonance Security

Resonance offers powerful cybersecurity aggregation software that makes protecting against full spectrum cybersecurity threats effortless no matter what your technical level, budget, or scope.

Pvotal Technologies

Pvotal Technologies

Pvotal Technologies engineer complex, automated processes aligned with best AIOps, BizDevOps, DevSecOps, CloudOps, and ITOps practices.