One down, one to go? The EU’s other hard border (the data one)

Whisper it quietly, but you might be living through a remarkable moment in European history. If things go to plan then this could be the fortnight that goes down in the history books as the one in which the EU managed to strike deals that solved two of its hardest and longest running trade border issues.

If you’re reading from the UK, then you have spent the week reading headlines that are daring to imagine that the UK and the EU have managed, after almost seven years of bitter wrangling, to find a solution to the issue of ‘hard borders’ for goods in Northern Ireland. The deal isn’t done yet, but you can almost begin to dream.

But alas, if your business is one that trades in data rather than physical goods, then you know that the bloc has an even longer running trade issue to solve. Specifically, the self-inflicted border that it has repeatedly put in place between itself and the United States of America which serves to restrict flows of data from the EU to the US.

But this week we have some new green shoots – a tantalising suggestion of free flowing data across the Atlantic – which comes to us in the form of a draft adequacy decision from the European Commission that might allow unfettered data flows across the Atlantic once more. All that needs to happen is for that draft to survive being torn to shreds by the European Parliament and European Court of Justice. Like I say, you can almost begin to dream.

As a refresher, since 2015 the EU has considered the US to be a jurisdiction which fails to provide adequate protections for data subjects, so has refused to grant an ‘adequacy decision’ which permits data controllers to move data out of the EU and onto US servers without first putting special safeguards in place. In other words, one can’t send data from Europe to America without first going through a compliance process to assess whether that transfer is strictly necessary, and if it is then putting compliance processes in place to manage it.

That isn’t the case for a limited number of overseas destinations, which includes the UK, Israel, Canada, South Korea, and a short list of other approved jurisdictions. All of which have an automatic ‘green light’ from the EU, which makes it as easy to send data to London as to Lisbon, and to Seoul as to Seville. But if you want to send data to Pittsburgh, then you need to go through exactly the same compliance procedure as if you were sending that data to Pyongyang.

Given the USA’s continued dominance in software and online services, and the centrality of those services to the functioning of the modern day web, the lack of an adequacy decision for the US puts an inevitable compliance burden on most European companies and acts as a material brake on their adoption of innovative technology from the States. Speaking personally, I know from experience that the data border can be a huge headache for UK and EU based technology companies. Without proper management the issue can stifle collaboration between group companies and reduce the value of data assets created in the EU.

So the latest proposal from the Commission is welcome news. But it needs to be considered with some caution. This isn’t the first time that the EU Commission has tried to grant ‘partial adequacy’ to the US. In fact, it’s the third attempt to come up with a regime that sticks. The first two adequacy decisions , ‘Safe Harbour’ and its successor ‘Privacy Shield’, were both initially granted and endorsed by the Commission but were then torn down and declared unlawful by the EU’s supreme court, the Court of Justice of the European Union.

There are early signs that this latest iteration will face similar headwinds, with important factions in the European Parliament already calling on the Commission to reconsider its position, and many familiar names gearing up to issue legal challenges should it ever come into force (and if it does, expect a Schrems III judgement in the immediate future).

But for now there’s cause for optimism. The current mood music coming out of the Berlaymont really does seem to be playing a tune of breaking down trade borders rather than keeping them up. It’s still early days, but it’s no longer crazy to dream that 2023 might just be that the data wall across the Atlantic finally comes down for good.