Looser digital rules could damage, not help, Britain's tech sector – The Economist

BRITISH BANKS, manufacturers and telecoms firms must all process information about European customers and suppliers. Ensuring that they could keep doing so was one of the government’s main considerations when negotiating withdrawal from the EU. In June, six months after its final departure, Britain received word that its data-processing rules had been judged “adequate”—that is, similar enough to the EU’s General Data Protection Regulation (GDPR) that data could keep flowing freely.
Your browser does not support the <audio> element.
Enjoy more audio and podcasts on iOS or Android.
But three months later the government opened a consultation on changing those rules. It outlined ambitions to create an “innovation-friendly data-protection regime” that would make it easier for data to be used “responsibly” and for organisations to comply with “flexibility”. Its call for responses closed on November 19th. One came from Lord David Anderson, a barrister with Brick Court Chambers and expert in European law. In short, he thinks the proposals risk tipping Britain out of alignment with EU law, thereby putting adequacy—and data flows—at risk.
As Lord Anderson’s 25-page legal opinion explains, the government’s proposals would mean moving in the opposite direction to the EU, towards more rights for companies that hold data and fewer for the individuals whom GDPR treats as the owners. Using personal data for political advertising, or purposes beyond those originally envisaged, would become easier. The category of “legitimate interests”—that is, uses to which data can be put without asking permission—would be expanded. That, according to techUK, a trade association that represents Google and Facebook among others, would make all sorts of useful things easier, from detecting fraud to making networks more secure.
Tech firms seem unflustered about risks of the sort raised by Lord Anderson. They seem sure that politics and economics are on their side. If Britain were to lose friction-free access to EU data, it would be a mutual disaster. Businesses in both places would face new costs from either having to write fiddly new contracts that create a workaround or, in the worst case, having to relocate. It would seriously hamper the sort of data-sharing upon which both sides’ police and national-security agencies depend. And so the European Commission, to which decisions regarding adequacy fall, is unlikely to find Britain wanting. TechUK’s members seem to be banking on pragmatism to protect them.
But Lord Anderson is far from alone in his view of the risks. On November 22nd the EU’s data-protection supervisor, Wojciech Wiewiorowski, who sits on the board that advises the commission on data-protection issues, told Mlex, a trade publication that covers regulatory issues, that if the proposed changes become law a discussion about Britain’s adequacy will certainly be triggered. And as for pragmatism, courts are not known for it. A challenge to adequacy in the European Court of Justice might succeed. Such a case might not be brought, let alone be won, but the British government’s plans make one more likely.
Any change to Britain’s data-protection rules minor enough to retain adequacy would be wasted effort, says Hussein Kanji, a partner at Hoxton Ventures, a venture-capital firm based in London. Having to comply with two sets of rules instead of one would amount to a “tax on small businesses”. The huge regulatory and compliance burden created by such a dual regime could be absorbed only by the biggest companies, says Poppy Wood of Reset, a non-profit organisation that focuses on technology policy (and which played a part in commissioning Lord Anderson’s opinion via its retained law firm, AWO). For startups those extra costs could represent the difference between success and failure.
What might satisfy techies like Mr Kanji and Ms Wood, as well as British business and even the British government, would be a sensible reassessment of GDPR. It is now, for better or worse, the de facto global standard. With Brexit, however, Britain lost all influence over the EU’s approach to data. In its attempts to regulate better than the bloc, it should at least take care not to make life for its own businesses worse.
This article appeared in the Britain section of the print edition under the headline "Is “adequate” good enough?"
A daily newsletter with the best of our journalism
But three years after the law changed, they cannot get it
Brexit is only one factor
The veteran editor is back at the Daily Mail, with more power than before
But three years after the law changed, they cannot get it
Brexit is only one factor
The veteran editor is back at the Daily Mail, with more power than before
How to fix Britain by reforming public schools, the City and the House of Lords
Published since September 1843 to take part in “a severe contest between intelligence, which presses forward, and an unworthy, timid ignorance obstructing our progress.”
Copyright © The Economist Newspaper Limited 2021. All rights reserved.