The European Parliament’s Committee on Civil Liberties (LIBE) adopted on Tuesday 11 May (37 votes in favour, 30 against and one abstention) a draft resolution rejecting the European Commission’s approach to the adequacy of the UK’s personal data protection regime with EU law (see EUROPE 12662/2).
MEPs therefore call for the two proposals for decisions, which the Commission submitted at the end of February, to be amended to bring them into line with European case law and recent opinions issued by the European Data Protection Board. The latter considers that the UK’s bulk data access and transfer practices need to be clarified.
The LIBE Committee goes even further: it considers that, if the implementing decisions are adopted without any changes, the competent national authorities should suspend transfers of personal data to the UK.
“The Civil Liberties Committee considers that a decision on adequacy should be granted only after the specific elements of UK law or practice that are still a matter of serious concern have been properly assessed. Therefore, we call on the Commission to modify the implementing decision to avoid repeating previous mistakes”, said Juan Fernando López Aguilar (S&D, Spain), chair of the committee and rapporteur on the dossier, in a statement.
A similar legal framework does not remove concerns
While the LIBE Committee recognises that the basic legal framework in the UK is similar to that in the EU, MEPs have a number of concerns about the application of the regime across the Channel.
This is the case, firstly, with the national security and immigration exemptions, which now apply to EU nationals who wish to settle - or remain - in the UK. In the absence of judicial oversight of policies in these areas, the UK executive has wide powers, say MEPs, who are seeking clarification.
MEPs also want metadata, which is often presented as ‘secondary data’, to be given its proper value and treated as equally sensitive data.
Finally, MEPs are also concerned about onward data transfers to third countries. London’s data sharing agreements with Washington make it possible to share data of EU citizens with the US, despite EU Court of Justice rulings that US data access and retention practices are incompatible with the General Data Protection Regulation (GDPR).
The draft resolution will be debated and voted on on 20 May in the European Parliament plenary session. A discussion on the ‘Schrems II’ judgment (see EUROPE 12529/2) concerning data transfers from the EU to the US (see EUROPE 12702/9) will take place on the same day. (Original version in French by Thomas Mangin)