The cost of data inadequacy

Download the report

Following the end of the Brexit transition period on 31 December 2020, the legal basis for transferring personal data across the Channel fundamentally changes. Unless the UK receives an adequacy decision from the EU, businesses and other organisations will no longer be able to freely transfer data from the EU to the UK, without putting in place their own additional measures. These measures can be costly, bureaucratic, and time-consuming to implement.

Although the UK has high standards of data protection via the Data Protection Act 2018, which enacted the General Data Protection Regulation (GDPR) in UK law, an EU adequacy decision is not guaranteed. Potential EU concerns with UK national security, surveillance and human rights frameworks, as well as a future trade deal with the US, render adequacy uncertain. Furthermore, EU-UK data flows are at the whim of the wider Brexit process and negotiations.

This landmark report outlines the economic cost and implications of the UK not receiving an adequacy decision from the EU. We look at the impact on businesses, different economic sectors, and the wider economy. We believe that this is the first comprehensive report analysing this issue from an economic perspective.

Through extensive interviews with over sixty legal professionals, data protection officers, business representatives, and academics, from both the UK and EU, we found that the risk of the UK failing to secure an adequacy decision is both real and serious, and that the impacts would be complex, leading to significant uncertainty. 

New modelling prepared for this report estimates that the aggregate cost to UK firms of no adequacy decision would likely be between £1 billion and £1.6 billion. This extra cost stems from the additional compliance obligations – such as setting up standard contractual clauses (SCCs) – on companies that want to continue transferring data from the EU to the UK. We believe our modelling is a relatively conservative estimate as it is underpinned by moderate assumptions about the firm-level cost and number of companies affected. We estimate that the average compliance costs for a business that is affected would be:

• £3,000 for a micro business
• £10,000 for a small business
• £19,555 for a medium business
• £162,790 for a large business

This overall figure of between £1 billion and £1.6 billion represents money that companies would have been free to spend to meet the requirements of the business by, for instance, investing in new equipment, staff, or processes, but are now required to channel into compliance activities or additional costs for goods and services, due to EU-UK data flows disruption.

No adequacy decision would also have a range of other economic implications, including:

• Increased risk of GDPR fines, due to the new compliance requirements
• Reduction in EU-UK trade, especially digital trade
• Reduced investment (both domestic and international)
• Relocation of business functions, infrastructure, and personnel outside the UK

We explain in detail why no adequacy decision would have these implications and why they matter – but we do not model the wider macroeconomic cost. Further research is required on this. Indeed, there is very little research on the value of data flows and adequacy decisions in general. However, EU-UK data flows are a crucial enabler for thousands of businesses. These flows underpin core business operations and activities which add significant value. This is not just a digital tech sector issue – the whole economy relies on data flows.

The combination of a potential no-deal Brexit, coupled with the developing Covid-19 pandemic, means that business and the economy can ill afford more cost, complexity, and risk. Although the adequacy decision is in the hands of the European Commission, the UK government still has a large part to play.

All parties hope that the outcome of the last few years of Brexit negotiations will be a comprehensive partnership agreement. This will be an important achievement of huge social and economic significance. Without a wider agreement on the future relationship, adequacy will be very hard to attain.

Recommendations

To help mitigate future uncertainties around the economic effects of restrictions to data transfers, we propose that:

1. The government should make relevant data and modelling tools available to support empirical research on the social and economic impacts of data protection, digital trade, and the value of data flows, in order to improve the quality of public policy and democratic engagement in these areas.

The UK government has expressed a commitment to maintain a world-class data protection system and remain broadly aligned with the EU’s GDPR, while developing its own ​“pro-growth data rights regime”, as explained in the National Data Strategy. To have the best chance of obtaining adequacy, the UK should consider demonstrating how it will maintain a regulatory level playing field with the EU on data protection, both domestically and in its trade agreements:

2. The government should further explain how the changes to the UK’s data protection regime outlined in the National Data Strategy, designed to promote growth and innovation, will also strengthen and enhance the rights of UK and EU citizens.

3. The government should consider the impact of future trade agreements on data protection, and carefully review the trade-offs involved when liberalising cross-border data flows with different countries.

The UK government should also strengthen measures to support business if the UK fails to secure an adequacy decision. We recommend that the UK government should:

4. Continue to raise awareness of the risks and costs of a lack of adequacy within the business community, both inside the UK and in the EU.

5. Provide simple, practical tools, including information on additional safeguards, to enable UK organisations to continue to use SCCs, given the issues raised by Schrems II.

6. Set aside funds to ensure that struggling UK businesses, especially Ssmall and medium enterprises (SMEs), can afford to comply with the new requirements.

Our report concludes that no adequacy decision has the potential to be a contributing factor which undermines the competitiveness of key UK services and digital technology sectors, which have performed extremely strongly in recent years. Although we do not want to exaggerate the impacts – and no adequacy decision is far from economic armageddon – this outcome would be far from ideal.