Thread by @markscott82

Now that a ‘No Deal’ #Brexit is looking like the most likely outcome, I would (again) bang the drum for how this is really bad news for anyone who moves data btwn the UK & EU, and vice versa.

Here’s why:

Right now, as an EU country, the UK is part of the region’s privacy regime, meaning that anyone (tech company, bank, retailer) can move data freely across the EU-28. It’s the lifeblood of the economy, particularly for professional services — something that the UK does really well

But in a no-deal scenario, that ready access is turned off overnight. No ifs, ands or buts. The UK says it’ll keep data moving from its side to the EU (yay!). But the EU says you won’t be able to move data from EU-27 to UK, unless you have special mechanisms in place

What does that mean? Well, say I’m a UK-based bank, and I want to move trading data to my outfit in Frankfurt, and then move it back. Well, that will either not be allowed, or will have to go further legal hurdles, possibly hobbling the biz

Or, say, you’re a UK-based store, and you have customers in France. Again, you can move data from UK to France, and then getting it back again (to keep your biz running) also gets 1000% more tricky

The UK govt know all of this. Here’s #Brexit Secretary @SteveBarclay giving evidence to UK Parliament: “The U.K.’s position is that we’ll take a permissive approach, so there would not be large risks for a U.K. company sharing its data with Europe."

But, and here’s the kicker: “But there would, potentially under the current Commission position, be a legal risk for a European company sharing that data with the U.K.”

For ‘legal risk,’ read: you won’t be able to move data from EU to UK, period.

Now, I get it. This is super geeky stuff, and less relatable than the (incredibly legitimate) issues around Northern Ireland, EU-UK migrant rights, etc. But the UK (and EU) economies rely on this easy flow of data to keep things ticking over in the economy

So shutting this down overnight is a really really big deal. And if you’re a biz who hasn’t thought about this until now, well, I’m sorry, but time has pretty much run out on you to get your house in order (double yay!)

For years, the UK govt has wanted to start negotiating w/ EU over how to fix this, though its knowledge (imho) over how this works leaves much to be desired.

Brussels, too, is eager, though hamstringed b/c Barnier says this is a matter for the UK-EU’s future relationship, meaning everyone is on hold until a deal (or no-deal) is struck. Bravo, Brussels, Bravo.

So where does that leave us? The UK says it should be easy to reach a deal w/ EU on data b/c London already complies w/ EU rules, so it’s just about signing on the dotted line.

Frankly, that’s just wrong.

Why? B/c sure, UK follows existing EU privacy rules. But when it leaves, it falls out of that regime to become a ‘third party’ country w/ higher obligations to EU privacy rules, including UK’s national security agencies’ collection of data falling under the remit of Brussels

That means UK’s Investigatory Powers Act and how GCHQ, et al collects data on EU citizens become fair game for EU to push back on (as a current EU member, the UK bypasses these issues b/c national security is a national competence), and legal challenges are almost likely

So where does this leave us? I will take UK govt’s point at face value that they want a deal. But in the likely scenario of UK crashing out on Oct 31, expect significant roadblocks to data transfers, and the likely knock-on effect on tech, finance, professional services, etc

I hope this does not happen, and we can all look back and say this was another Y2K hoax. But talking to ppl whose job it is to prepare for this scenario are (rightly) concerned that it’s not getting the publicity that it deserves.

Again, there are bigger issues at play in a no-deal Brexit. But in a world where Europe already punches below its collective weight on many data-related issues, this feels like an unnecessary own-goal at a time when all of Europe (and not just EU or UK) need to do better.

Rant over. Thoughts appreciated.

PS (for the privacy geeks out there): currently, UK-based companies can get around these Brexit-related issues if they have so-called ‘standard contractual clauses’ in place — a EU-approved mechanism that allows data transfers from EU to third-party countries like US, China & UK

But (and you gotta love a but), these mechanisms are currently under legal threat at Europe’s highest court in case brought by @maxschrems in relation to how @Facebook moves EU data to US, and how that may breach EU privacy rules.

A decision in that ECJ case is due sometime next year. And if the judges rescind the use of these clauses, it’ll mean that EU data transfers to any third-party country (inc UK) may also be turned off overnight, cutting off one of only other routes to move EU data to UK.

Right, I’m off to hunt for more coffee. Enjoy your weeks!