The Irish Citizenship Authority says the UK should be denied EU...

The Irish Civil Liberties Council has written to the European Commission, arguing that post-Brexit, the UK should be denied a key adequacy status in handling EU citizens’ personal data.

If the EU agrees, it would mean that UK-EU trade could be affected, potentially affecting “billions” in trade according to ICCL.

The letter was sent by Johnny Ryan, who recently joined the ICCL as a Senior Fellow after serving as Chief Privacy Officer on the Brave web browser.

In the letter, Dr. Ryan highlighted the lack of adequate privacy protection in the UK in what he describes as a failure to handle complaints about real-time bidding methods in the online advertising ecosystem. Mr. Ryan has already described this real-time bidding setup as the “Biggest Data Breach Ever”.

“According to Article 45 (2) (b) of the GDPR, an adequacy decision is not possible because the UK data protection supervisory authority, the Information Commissioner’s Office, fails the test of an effectively functioning supervisory authority,” said ICCL Senior Fellow Johnny Ryan in a letter to three key EU commissioners, Margrethe Vestager (competition and digital), Didier Reynders (justice) and Thierry Breton (internal market).

“The UK lacks an effective independent regulator capable of enforcing data protection law compliance and defending the rights of data subjects. As a result, the personal data of data subjects in the Union do not currently have an adequate level of protection in the UK. So we suggest that the inevitable conclusion is that the UK cannot benefit from an adequacy decision at this time. ”

Dr. Ryan and the ICCL previously complained to the Irish Data Protection Officer about the same real-time bidding issue.

Last month, he released data suggesting the system will allow online advertising companies to treat incest survivors, AIDS patients, and substance abuse victims as advertising categories, in breach of EU rules that cover particularly sensitive activity categories, including some health topics, should except.

“The consequences of this should be of the utmost concern to the European Commission as they endanger the right to personal data protection and go so far as to interfere in elections within the Union,” said Dr. Ryan in his letter to the EU commissioners.

“The ICO has not taken significant action in the past two years to address the largest data breach the UK and EU have ever seen. It would be unreasonable to expect it to do better after Brexit is over. ”

Dr. Ryan said that failure to make an adequacy decision by the European Commission would create “friction and uncertainty” in data transfers between the EU and the UK, which could jeopardize 13 percent of the UK’s global exports.

“The UK government reports that UK exports of personal data services to the EU amounted to £ 85 billion in 2018,” he wrote. “The UK’s total global exports were £ 655.5 billion that same year.”

The UK’s information commissioner’s office said it was “ready for its new role as the UK data protection regulator both during the transition and beyond” and was providing “guidance and advice to businesses as they advance into the transition period”.

The UK’s Department for Digital, Culture, Media and Sport stated in an email that it is “committed to high data protection standards and the UK is a world leader in protecting people’s personal data”.

The ICO “already meets the EU’s criteria for an effective and independent data regulator and is able to fulfill this role during the transition period and after its end,” the DCMS said.

The European Commission declined to act immediately, without indicating that adequacy talks are currently being held with the UK. The aim is to make a decision “by the end of 2020 if the applicable conditions are met”.

[Additional reporting Bloomberg]

Online editors