Commission Position Paper on Data Protection and Protection of Information obtained or processed before the Withdrawal Date

Jane Lambert

On 6 Sept 2017, the Commission's Art 50 TaskForce published a position paper that had been transmitted to the 27 remaining states on the use of data and protection of information obtained or processed before the withdrawal date. That document contains the main principles of the EU position in that regard.

The Commission's starting point is that "the United Kingdom's access to networks, information systems and databases established by Union law is, as a general rule, terminated on the date of withdrawal." Such access may continue only if we fulfil the conditions set out in the position paper.

 The first of those conditions is that

"The provisions of Union law on personal data protection applicable on the withdrawal date should continue to apply to personal data in the United Kingdom processed before the withdrawal date and pertaining to

(i) data subjects in the EU27,
(ii) data subjects outside the Union,

to the extent that this data is covered by Union law on personal data protection before the withdrawal date." 

Those provisions will be contained in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("the General Data Protection Regulation") and Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ("the Data Protection Directive"). Since the Data Protection Bill will preserve the provisions of the GDPR and the Data Protection Directive in national law after our withdrawal from the EU, that condition should not be a stumbling block.

The Commission also requires the United Kingdom Government to protect European Union and national classified information after we leave the EU to the extent that it does so now. That includes obliging contractors and sub-contractors to comply with those requirements. Again, the Commission appears to be pushing at an open door for the Department for Exiting the European Union has already indicated in the UK position paper Confidentiality and access to documents that:

1. The UK recognises the importance of continuing to respect obligations of confidentiality and to protect information exchanged while it was a Member State. 
2. The UK considers that arrangements agreed with respect to confidentiality and the handling of information produced while it was a Member State should be reciprocal, affording an equivalent level of protection to the UK and the EU after the UK’s withdrawal. 
3. These protections should be equivalent to those set out in the existing regimes.

In principle, the positions of the Task Force and British Government on data protection and the protection of classified and other restricted information do not seem too far apart. The Commission has combined data protection and protection of classified information in one document whereas the DExEU has addressed those topics in two separate position papers. However, problems may emerge when it comes to details such as whether the Commission will expect the UK to abide by decisions of the Court of Justice on the interpretation of the GDPR or other legislation after we leave the EU.

Anyone wishing to discuss this article or any other matter relating to Brexit should call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form.