show image

US Cloud Act may threaten UK data adequacy decision, warns EDPB

A powerful committee of data protection regulators has warned that the US Cloud Act could threaten Britain’s right to an EU data adequacy decision after Brexit.

The controversial legislation makes it easier for US and UK authorities to access data stored by digital service providers stored in the other’s territories.

But the European Data Protection Board (EDPB) has warned that, after the Brexit transition period ends, the legislation could mean that EU citizens’ data is stored in the UK is not held to EU standards.

This could impact the UK’s request for a data adequacy decision, which would allow for data to flow freely between Britain and the EU, but will only be granted if European officials deems British data protection law equivalent to the EU’s.

In a letter to MEPs, the EDPB, which represents data protection regulators across the continent, states: “Considering the provisions of the agreement, read in conjunction with Sections 3 of the US CLOUD Act2 , the EDPB has doubts as to whether the safeguards in the agreement for access to personal data in the UK would apply in case of disclosure obligations applicable to providers of electronic communication service or remote computing service under the jurisdiction of the United States, regardless of whether the data requested is located within or outside of the United States.

“Following this preliminary assessment, it is unclear whether the safeguards enshrined in the Agreement would apply to all, if any, requests for access made under the US CLOUD Act.”

On the subject of a data adequacy decision, the committee adds: “The EDPB considers that the agreement concluded between the UK and the US will have to be taken into account by the European Commission in its overall assessment of the level of protection of personal data in the UK, in particular as regards the requirement to ensure continuity of protection in case of “onward transfers” from the UK to another third country.”

The letter is likely to raise eyebrows in the British business community, which has warned that a failure to secure a data adequacy decision after Brexit would hinder its ability to trade in the European Union, making UK businesses less competitive.

Sophie in ‘t Veld, the MEP who had requested the EDPB’s opinion on the matter, tweeted: “Boom! Warning shot by European data protection watchdog on EU-UK data sharing and EU-US data sharing. Playtime is over. Safeguards deemed insufficient.”