The UK has reportedly moved closer to agreeing the terms for data transfers with the European Union post-Brexit amid concerns about the impact it will have on business.
According to The Times, citing unnamed government sources, negotiators on either side of The Channel have reached a "tentative agreement" on the exchange of data.
The report suggested this was made alongside talks on a financial services deal – to allow UK companies access to European markets if British financial regulation remained aligned with the bloc's – but didn't detail the terms of a data agreement.
UK.gov tells companies to draft contracts for data flows just in case they screw up BrexitREAD MORE
Meanwhile, government sources moved to distance themselves from the reports, as Labour MP Bill Esterson noted in Parliament today. Digital secretary Jeremy Wright stressed that a timetable had not yet been agreed.
The government is under increasing pressure over its plans for ensuring data can flow between the UK and the remaining 27 member states after Brexit.
The UK said back in August last year that it wanted to strike an adequacy-plus deal with the EU – this would allow data to flow and grant the UK a place at the top table – but was less open about the prospects in a no-deal scenario.
In Parliament today, Wright told MPs: "One of two things will be true: either we will reach a deal with the EU, in which case I expect data to be part of that deal; or we will not, in which case we will seek an adequacy decision."
The UK government has consistently said it is ready to start talks over an adequacy decision, which involves the EU assessing whether a country has the same standards of data protection, but that the EU is not. Brussels' chief negotiator Michel Barnier has repeatedly said an adequacy decision cannot be taken until the UK has formally left the EU.
These assessments can take about two years, which throws into question what will happen during the interim period. However, digital minister Margot James last week told the House of Commons' European Committee the government is "optimistic an adequacy decision will not require the usual length of time", but declined to offer more specifics.
She also pointed to a technical note issued in September as part of the no-deal preparations to demonstrate the government had given advice to companies on what to do during the discussion period on adequacy.
This notice recommends that companies wanting to receive personal data from organisations in the EU, including data centres, should draw up new legal bases, such as standard contractural clauses.
This gave businesses less than six months to organise new contracts, but the government failed to acknowledge the tight turnaround or the financial burden it would place on firms, especially smaller ones.
UK.gov isn't ready for no-deal Brexit – and 'secrecy' means businesses won't be eitherREAD MORE
However, according to Politico, ministers were briefed on these risks before the summer recess. The Brussels-based paper reported that a note circulated to politicians warned of "substantial disruption" and "significant legal costs" for businesses without a Brexit deal on the transfer of data.
The government has also been unwilling to discuss the possibility that it might not be granted an adequacy agreement.
Concerns have been raised about the UK's surveillance laws – until now the country has been able to rely on national security exemptions granted to member states – and exemptions the UK carved out in its Data Protection Act, particularly on immigration.
Liam Byrne, shadow digital minister, outlined these during the Commons committee debate with James, saying he was "much less sanguine than the Minister about the possibility of an adequacy agreement".
He later slammed the minister's inability to offer a concrete timetable for discussions with the EU, and for failing to confirm whether there would be a deal in place for the implementation period.
"Without data-sharing our exports will grind to a halt," he said. "This is incompetence on a simply staggering scale." ®