Losing data adequacy not a ‘complete disaster’, says Whittingdale

On Friday last week, John Whittingdale was appointed as the acting minister in both the Department for Culture, Media and Sport and the Department for Science, Innovation and Technology. The appointment will take effect when the incumbent minister, Julia Lopez, begins her upcoming maternity leave.

Lopez’s ministerial brief includes oversight of the proposed new Data Protection and Digital Information (No. 2) Bill, which was introduced into the UK parliament last month. Speaking in a debate concerning the Bill on Monday last week, Lopez said the government is confident that the UK will “maintain adequacy following the enactment of the Bill”. She said the UK government has been in “constant contact with the European Commission” about the proposed new Bill and does not consider that the Bill “will present a risk” to the UK’s adequacy status.

In the same debate, Whittingdale said that there would be “ways around” the loss of adequacy for businesses to maintain data flows from the UK to the EU if the European Commission did withdraw its existing adequacy designation for the UK.

Whittingdale, who previously served separate terms as secretary of state for culture, media and sport, and as minister for media and data, said: “There is an advantage in the UK’s retaining data adequacy with the EU. It was not taken for granted that we would get data adequacy. A lengthy negotiation with the EU took place before a data adequacy agreement was reached. As part of that process, officials rightly looked at what alternative there would be, should we not be granted data adequacy. It became clear that there are ways around it.”

“Standard contractual clauses and alternative transfer mechanisms would allow companies to continue to exchange data. It would be a little more complicated. They would need to write the clauses into contracts. For that reason, there was clearly a value in having a general data adequacy agreement, but one should not think that the loss of data adequacy would be a complete disaster because, as I say, there are ways around it.”

Whittingdale added that it was notable that New Zealand had been designated as providing for adequate data protection by the European Commission despite having different data protection legislation in place to the EU. He highlighted the fact that UK information commissioner John Edwards used to be information commissioner in New Zealand and said that he “brings a particular degree of knowledge” about New Zealand’s adequacy designation which Whittingdale said would be “very useful”.

Whittingdale will not be the senior minister in the Department for Science, Innovation and Technology – the department responsible for the Bill – when he takes on his acting position. Michelle Donelan is the secretary of state in the department, though she too is set to take maternity leave. Chloe Smith has been appointed as her acting replacement and, like Whittingdale, will take up her role when Donelan’s maternity leave is triggered.

The UK government has previously described the proposed new Bill as a “common-sense-led UK version of the EU’s GDPR” and has estimated in its impact assessment that the net value of its reforms over 10 years would be between £1.3 billion and £8.5 bn. However, the government has also estimated that the loss of its EU adequacy decision would cost businesses between £2.3 bn and £4.6bn in one-off costs and lost annual export revenue over the same period.

In a statement issued alongside the revised Bill published in March, the government said that the Bill was “expected to unlock £4.7 billion in savings for the UK economy over the next 10 years”. The reason for the different estimate has not yet been set out, but the government has said that a revised impact assessment will be published once the independent scrutiny process has been completed.