The EU-UK Trade and Cooperation Agreement (TCA) stipulates, in Article FINPROV.10A, that, from the coming into (provisional) effect of that agreement, i.e., from 1 January 2021, for a “specified period” of four months (extendable to six months), subject to certain conditions:
“transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country under Union law”
This means that under Article FINPROV.10A TCA, as far as transborder transfers of personal data from the EU/EEA to the UK are concerned, the UK will, for some (supposedly limited) time and subject to those conditions, be treated as if it were still an EU Member State.
In this respect (for this period and subject to those conditions), Boris Johnson’s government therefore actually did get to “have its cake and eat it”: the UK is no longer an EU or EEA Member State, but it still gets to be treated as if it were an EU/EEA Member State.
There are five main reasons why the stipulation in Article FINPROV.10A TCA is unacceptable in EU law:
- the stipulation fundamentally undermines EU data protection law as guaranteed by the EU Treaties, the EU Charter of Fundamental Rights and the EU data protection instruments as interpreted by the Court of Justice of the EU;
- as a matter of official EU policy, the issue of data protection (including in respect of transfers of personal data) should not be addressed in a free trade agreement – but Article FINPROV.10A does precisely that;
- the conditions under which the stipulation applies are insufficient and in particular fail to address the issue of UK mass surveillance – which is a matter directly relevant to the issues of data protection adequacy and data transfers;
- the “specified period” of four to six months can be extended by the EU and the UK at will;* and
- the stipulation assumes that a (positive) adequacy decision on the UK will be issued within the “stipulated period”, when this is far from certain (to put it mildly).
* Those who feel that since Article FINPROV.10A says it will only apply for a few months it is not a big deal should read the section in this note on the fourth point, section 3.4, in particular.
I therefore urge the European Parliament, in the process for approval of the agreement, to insist that Article FINPROV.10A be removed – or at least, that full and formal binding assurances are given that the four to six month period will not under any circumstances be further extended, not even, indeed especially not, if the Commission concludes that the UK does not provide “adequate”/“essentially equivalent” protection to personal data, given its excessive mass surveillance activities.