It is in both the UK and the EU’s interest to ensure that regardless of whether the UK withdraws from the EU with or without a deal, regulators can continue to share data and information post 29 March 2019.
Regulator to regulator information sharing
The Political Declaration published on 22 November 2018 envisages a clear spirit of mutual cooperation, stating that reciprocal equivalence frameworks will be put in place enabling both the EU and the UK to declare a third country’s regulatory and supervisory regimes “equivalent”. This is particularly important where there is a cross border investigation occurring which may involve both the UK and other EU countries.
The Withdrawal Agreement provides that such equivalence assessments should begin as soon as possible after 29 March 2019 but conclude before the end of June 2020. Following the transition period, any personal data already collected by private and public bodies in the UK will continue to be subject to EU data protection rules until the European Commission is satisfied that the UK has an adequate level of protection of personal data by reason of its domestic law or the international commitments it has entered into. Thus, any ongoing regulatory investigation in the UK which involves data from other EU countries will continue to be subject to EU data protection rules until such a decision is adopted.
In the case of a no-deal Brexit, the UK has stated that any personal data already collected by private and public bodies in the UK will follow the EU regulatory regime, thereby facilitating transfers of data from the UK to the EU and thus, there will be no immediate change in the UK’s own data protection standards. However, data from the EU to the UK will not be able to be transferred until agreement is otherwise reached unless organisations implement a data transfer mechanism under the GDPR. This process was discussed in recent information notes issued by the European Data Protection Board. This may cause issues in the short-term for EU regulators who require data from the UK in respect of their ongoing investigations.
Financial Crime
The Withdrawal Agreement provides for ongoing police and judicial cooperation in criminal matters throughout the transition period, during which time European law will continue to apply. Negotiation will be required during that time to develop a new relationship with Europol, the EU police intelligence agency, and Eurojust, the coordinating network of EU prosecuting agencies. The UK and EU will also have to come to an agreement in relation to mutual legal assistance. However, it is unlikely that either the UK or the EU will want to see any reduction in cooperation in investigating and prosecuting criminal activity. It is therefore anticipated agreement might be reached on these issues.
In the event of a no-deal Brexit, the UK has published proposed regulations to be implemented, the Law Enforcement and Security (Amendment) (EU exit) Regulations 2019. These Regulations seek to remove previous domestic implementation of EU legislation on mutual recognition of asset freezing and confiscation orders. The Regulations also provide that the UK will no longer be a party to Europol or Eurojust, and will no longer operate the European Arrest Warrant. Instead the UK will largely revert to the 1957 European Convention on Extradition (the “ECE”) regime. The Irish Government’s General Scheme of the Miscellaneous Provisions (Withdrawal of the United Kingdom from the European Union on 29 March 2019) Bill 2019 also proposes application of the ECE regime to extradition between the UK and Ireland. This may seriously impede the efficiency with which the UK will be able to combat illicit activity after 29 March 2019. The Serious Fraud Office has indicated that loss of access to EU measures and tools in this context will adversely affect investigations and prosecutions, representing a strategic risk to the UK.
This article was co-authored by Senior Associate Ciara Dunny.