BEERG Newsletter - EU/UK Data Transfers: Impact assessment hints at £190-£460m costs

Derek Mooney writes: The UK’s Department for Digital, Culture, Media and Sport has published its impact assessment for the UK’s Data Protection and Digital Information Bill (the Data Bill). The legislation itself, which is to reform the UK’s GDPR and other EU based privacy laws, commenced its progress through the legislative process last week. 

We will look at the legislation itself in more detail in September, after the Summer break, but we wanted to bring paragraphs 17 and 18 of the Impact Assessment to your attention just now.  In paragraph 17 the Department says that “…the Government’s view is that reform of UK legislation on personal data is compatible with the EU maintaining free flow of personal data from Europe”, in other words, it assumes that the UK will not lose its EU adequacy. It does offer any justification or explanation for this assumption - it simply asserts it.

However, Paragraph 18, does consider the possible implications if an EU adequacy decision “was not available” and accepts “that businesses would have to implement alternative transfer mechanisms to exchange personal data.” It then models its revised best estimates for the direct one-off costs to business and the loss in export revenue, saying:  

“As a result, we estimate the impact of Adequacy with the EU being discontinued on top of these measures to be between £190 and £460 million in one-off SCC (standard contractual clauses) costs and an annual cost of between £210 and £410 million in lost export revenue when taking a micro approach to modelling. 

The analysis does not attempt to assign probabilities but simply estimates the impact in the event of loss of Adequacy. The trade impacts are the direct reduction in UK-EU trade and the impact may be larger when accounting for interactions with onward supply chains with trade with third countries.” [BEERG emphasis]