The European Union's chief Brexit negotiator has poured cold water on the UK's dreams of a special deal on data adequacy* after it leaves the bloc.
In a speech given over the weekend, Michel Barnier said that the UK "needs to face up to the reality of Brexit" and the way the EU's decision-making systems work.
The UK has repeatedly proffered the idea that it should be granted a seat at the data protection negotiating table, and continue to be part of EU-wide mechanisms set out in the General Data Protection Regulation.
Brit MPs chide UK.gov: You're acting like EU data adequacy prep is easyREAD MORE
However, Barnier told the 28th Congress of the International Federation for European Law that the EU "cannot, and will not" share its decision-making powers with a third country.
And in comments that will add weight to concerns that the UK government is being complacent in its approach to continued data flows between the nation and the rest of the bloc, Barnier emphasised that the "only possibility" is an adequacy deal.
The UK government's plan – the practicality of which has been questioned repeatedly – is for the information commissioner to be handed a place on the European Data Protection Board, and for the UK to remain in the one-stop-shop mechanism.
This close cooperation aims to simplify matters for organisations that operate in a number of member states by allowing them to deal with just one supervisory authority – but is a right granted to only member states.
Politicians have argued that the EU should accept the proposal because it will benefit businesses across the bloc – but Barnier scoffed at the idea, saying the UK needed to be more realistic.
"Let's be clear: Brexit is not, and never will be, in the interest of EU businesses," he said.
"And it will especially run counter to the interests of our businesses if we abandon our decision-making autonomy. This autonomy allows us to set standards for the whole of the EU, but also to see these standards being replicated around the world."
Barnier added that EU "cannot, and will not, share this decision-making autonomy with a third country, including a former member state who does not want to be part of the same legal ecosystem as us".
He emphasised that the UK had "decided to leave our harmonised system of decision-making and enforcement" and "must respect" the fact the EU will continue to operate in the same way after Brexit.
In particular, he said that the UK's ideas to be involved in the cooperative mechanisms while not a member state "pose real problems" of law.
For instance, he asked who would launch an infringement against the nation in the case of misapplication of GDPR, who would ensure that the UK updated its own legislation when the GDPR was updated, and how it would be possible to ensure uniform interpretation of the rules on data protection.
"The United Kingdom needs to face up to the reality of the European Union. It also needs to face up to the reality of Brexit," Barnier said. "As indicated in the European Council guidelines, the UK must understand that the only possibility for the EU to protect personal data is through an adequacy decision."
However, this decision would also have to consider the UK's intrusive surveillance laws – until now, the country has been able to rely on national security exemptions.
* Data adequacy is the status granted by the EU to countries outside the bloc which it considers to have "equivalent" protections to those granted under European law.