The UK’s attitude towards upholding the European Convention on Human Rights and protecting people’s personal data has been severely criticised by members of the European parliament examining how the UK’s trade and cooperation agreement with the EU (TCA), post-Brexit, has operated.
The European parliament is required to give an opinion on this in the shape of a ‘resolution’.
It has all-party committees to help formulate this. The Committee on Civil Liberties, Justice and Home Affairs (LIBE) has just issued a highly critical report on the UK’s tendency to deviate from its agreements with the EU and from its obligations under international law. The government can’t afford to ignore this.
What does the TCA have to do with human rights and data protection?
The TCA is about trade between the EU and the UK, notably Northern Ireland, which effectively enjoys the benefits of remaining in the EU’s single market. But it rests on the underlying assumption that the UK can be trusted (as it had been for over 40 years in the EU) to uphold the rule of law and stand by agreements it reaches with partners. This is where the UK has come unstuck, and where any new UK government needs to tread with care.
The LIBE committee points out that part three of the TCA on law enforcement and judicial cooperation in criminal matters requires “respect for democracy, the rule of law and the protection of human rights and fundamental freedoms, including as set out in the Universal Declaration of Human Rights and in the European Convention on Human Rights (ECHR), as well as the commitment to high-level protection of personal data”. This is more than mere words. The UK has been criticised, too, by the Council of Europe.
So it is not surprising that the committee points out that the UK is placing this part of the TCA (due for review in 2025) in jeopardy “if the UK or a Member State denounces the ECHR”.
It states:
“Article 524 of the TCA provides that cooperation between the EU and the UK is based on the importance of giving effect to the rights and freedoms in that convention domestically.”
It sees current UK legislation as putting all at risk, including “The retained EU law bill, the data protection and digital information (No. 2) bill (DPDI2) and the illegal migration bill”. It is especially concerned that the UK will dilute protection for people, notably when exchanging and sharing personal data, and seek to erode standards on which EU citizens rely.
It warned that given that part three of the TCA allows for extended data flows between the EU and the UK, such as the exchange of DNA data, passenger name record data and criminal record information, it is “of the utmost importance that the UK ensures that the level of protection is essentially equivalent to that afforded by the European Union in order to avoid putting EU standards and therefore EU citizens’ fundamental rights at risk when sharing data with the UK”. It insists that the UK must abide by such standards when transferring EU data to other ‘third countries’ (non-EU states) and guarantee an equivalent level of protection for personal data.
If the UK fails, then the adequacy agreement between the EU and UK (facilitating data exchange) will be endangered. The European Commission has pledged to closely monitor the situation and repeal the adequacy decisions if privacy is no longer ‘essentially equivalent’ in the UK to that in the EU.
The UK can no longer be trusted
This highlights how the UK has slipped from rule-maker to rule-taker. It also illustrates EU vigilance where the UK is concerned. It is clearly no longer a trusted partner. If anything, it is seen as prone to making arbitrary decisions.
The committee states plainly that it:
“Strongly regrets the provisions in the new DPDI2 that would introduce new delegated legislative powers for the UK government to legalise data processing for national security, law enforcement and public authorities’ access to personal data held by private entities; is deeply concerned by the introduction of delegated legislative powers that provide for some fundamental aspects of data protection law to be changed by the UK government through secondary legislation; stresses the risks that these delegated powers pose to legal certainty and the future of the UK’s adequacy decision; and condemns the UK’s general and broad exemption from the data protection principles and data subject rights for the processing of personal data, set out in its Data Protection Act, for immigration purposes.”
It goes on to say that::
“The exemption in cases in which giving effect to data subjects’ rights would jeopardise effective immigration control or in the investigation or detection of activities that would undermine the maintenance of effective immigration control does not comply with the principle of legal certainty and therefore, is not sufficient to prevent arbitrary decision-making.”
This is damning enough but worse still is the potential impact of such arbitrary decision-making on individuals that the UK’s decision to allow for automated decision-making (in effect by an algorithm). The committee condemns the UK’s legislation for permitting the government to interfere in and compromise the independence of the Information Commissioner’s Office.
Abide by the rules, or you won’t be admitted into the new Prüm agreement
Effective, close and mutually beneficial law enforcement and judicial cooperation between the EU and the UK in view of their geographical proximity and shared challenges has been something the UK has worked for since Margaret Thatcher was prime minister. The Prüm agreement facilitates this.
Automatic admission into the revised Prüm arrangements to improve cross-border crime fighting isn’t guaranteed because the UK has failed to comply with many existing requirements, including the deletion of passenger name data, and fair treatment of EU nationals. LIBE stresses that the UK’s abysmal treatment of EU nationals – including the right to a fair trial – doesn’t respect the TCA’s principles of reciprocity and non-discrimination; and notes that the Commission could intervene before 2025.
Government rhetoric calling for judicial and police cooperation, along the lines the UK developed in the EU, hasn’t persuaded the EU that it can be trusted. Its actions matter. It has been warned: if its approach to human rights and data protection remain so poor, it will not get what it wants when the TCA is reviewed.
