The EU’s data protection rules are comprised of the General Data Protection Regulation, the Data Protection Directive, the EU-US Privacy Shield and the EU-US Umbrella Agreement. Once the UK leaves the EU, we will no longer be part of the EU-US Privacy Shield or the EU-US Umbrella Agreement and it is assumed the UK will be treated as a third country on all other data protection issues.
The purpose of this evidence session is to explore the Government’s views on the future arrangements for data sharing with the EU and the US whilst also identifying the key safeguards in the EU’s new data protection package, which is due to be implemented in the UK by 2018, that will ensure people’s fundamental rights will be protected.
The Committee is likely to ask Mr Hancock:
- Assuming the UK will be treated as a third country post-Brexit, what will be the default position as a matter of law for data flows between the UK and the EU if we haven’t secured an adequacy decision at the point when we leave the EU?
- What changes will need to be made to the 1998 Data Protection Act to bring it into compliance with the GDPR and the Data Protection Directive and what timeline is the Government looking at to make the necessary changes?
- Will the Government be seeking to obtain an adequacy decision to enable data sharing between the UK and the EU after Brexit?
- What will be the arrangements for data sharing between the UK and the US after the UK leaves the EU?