Brexit split with EU over personal data risks harm to UK business and security, report warns

Exclusive: Proposals ‘driven by desire to show benefit from Brexit’

A Conservative former home secretary has backed calls for Boris Johnson’s successor to ditch his Brexit plan to split from the EU on data regulation, amid warnings it will cost businesses billions.

A new report by the ex-leader of Tory MEPs, Lord Timothy Kirkhope, today warns Mr Johnson’s plan for a new UK-only rulebook on data security could cut Britain off from the free exchange of information within Europe, and undermine protections against international crime and terrorism.

Businesses could be locked out of lucrative markets and may relocate outside the UK in order to avoid the additional barriers to trade, while police and security agencies could lose access to vital information on suspects’ criminal records, fingerprints, DNA or car registrations, the report warns.

Author Lord Kirkhope, who led the Conservative group in the European parliament for six years and played a key role in drawing up the EU’s GDPR data security system, told The Independent that Mr Johnson’s “ideological” proposals appeared to be driven by the impulse to demonstrate benefits from Brexit.

But he said that “going it alone” for its own sake could deal a massive blow to trade in personal data-enabled services worth £85bn in exports from the UK to the EU and £42bn in imports from the EU in 2018.

And he warned Mr Johnson’s lighter-touch regulatory system could mean personal data ending up in the hands of corporations without citizens’ consent, in a way which is prevented by GDPR.

Former home secretary Amber Rudd cautioned against allowing UK agencies to be locked out of EU-wide security arrangements, such as the Prüm convention on cooperation in the fight against counterterrorism and cross-border crime, which rely on data adequacy agreements with Brussels.

Backing the report, she said: “In the interests of security, both for the UK and the EU, we should seek to maintain the free flow of data.

“As a former home secretary, I saw for myself just how important it was to have access to Prüm, the European Criminal Records Information System and other databases to help tackle serious crime.”

Former home secretary Amber Rudd has backed the report (Getty)

Data adequacy was an important part of negotiations for Mr Johnson’s Brexit deal, with the European Commission formally confirming in June 2021 that UK law provided equivalent protections to EU directives in the area.

Commission vice-president Vera Jourova made clear then that the status could be withdrawn at any time if Britain diverged too far from European norms, saying: “If anything changes on the UK side, we will intervene.”

But just over two months later, the Department for Digital, Culture, Media and Sport launched a consultation on how the UK could “reshape” its regulatory framework outside the EU with the adoption of “agile and adaptable” data protection laws. This was followed in January by a “Benefits of Brexit” paper setting out plans for a “pro-growth and innovation-friendly data protection regime”.

Mr Johnson boasted that this could contribute to an £11bn deregulatory boost to the UK economy from Brexit.

But today’s report, published by the Conservative European Forum and seen by The Independent, warns that the potential loss of data flows will cost British businesses far more.

The UK government has been warned not to put the flow of data with the EU at risk (AFP/Getty)

Lord Kirkhope said it was “imperative” for either Liz Truss or Rishi Sunak to “look again and reverse the UK government’s current policy” if they reach 10 Downing Street.

“The government is telling voters that it’s right for Britain to ‘do its own thing’ after Brexit,” he told The Independent. “That might appear to most people’s ears to be very attractive, but the truth of the matter is that once you veer away from the international standards, there are inevitably enormous costs and enormous threats to business.”

Without free flows of data, people might experience difficulties with their social media accounts, internet purchases or transferring money abroad. And companies could find themselves having to renegotiate contracts which currently stipulate GDPR compliance.

Some might try to operate under parallel UK and EU regimes, while others might move activities into the EU to avoid the burden of additional admin, the report warned.

Lord Kirkhope stressed he was not taking sides in the Tory leadership race and hoped both contenders would favour “pragmatism” over a commitment to tearing up ties with Brussels.

Liz Truss and Rishi Sunak are being urged to ditch Boris Johnson’s plan (PA)

But he said: “I hear Liz Truss saying ‘we can get rid of all this EU red tape’. Getting rid of the EU red tape in relation to data would seriously harm business and in international terms would make us stick out like a sore thumb and be less attractive to investors.”

His warning was backed by the Institute of Directors, whose director of policy Roger Barker said: "The pursuit of regulatory divergence from the EU for its own sake makes little sense to business.

“Maintaining a high level of equivalence between the EU and UK data protection regimes is highly desirable for UK business, given the huge magnitude of UK-EU imports and exports that depend on the free flow of data. The government has yet to persuasively demonstrate how regulatory divergence on data protection would deliver a net benefit to UK business.”

The British Chambers of Commerce said that the “data adequacy” agreement reached with the EU in 2021 provides “a vital foundation for continued data flows between both markets” and the UK government should be careful not to put it at risk.

Head of trade policy William Bain told The Independent: “Business would need to see a full impact assessment, details of proposed phase-in periods, and legal guarantees that any plans for regulatory divergence would be commensurate with maintaining our data adequacy relationship with the EU.”

While acknowledging business gripes that GDPR is “overly restrictive”, Lord Kirkhope said there was no appetite from industry to add another competing enforcement system.

“I can’t see a situation where if we’re going to do our own thing, we wouldn’t have to be at least as tough and probably with less flexibility than we have now,” he said.

“In the present economic climate, anything that actually has an adverse effect on our trade really seems to me to be completely unacceptable.”

And he was backed by Conservative former attorney general Dominic Grieve, who urged whichever of Mr Sunak or Ms Truss becomes the next prime minister to abandon Mr Johnson’s approach.

“Free flow of data is essential: for our economy, for our national security and for the future relationship between the UK and the EU,” said Mr Grieve.

“I urge the incoming government to change trajectory by putting pragmatism and the national interest above ideology. The report by Lord Kirkhope presents an opportunity to work collaboratively with our European partners, rebuild trust and prevent further damage.”