Japan Trade Deal punches USA-sized hole in privacy

The United Kingdom (UK) has just signed its first new free trade agreement, independently from the EU, with Japan. Open Rights Group (ORG) believes that clauses in the UK-Japan trade agreement pose an existential threat to data protection rights in the UK, as ORG outlines in a briefing.

The UK-Japan trade agreement, published in mid October, was supposed to be uncontroversial, negotiated in record time with minor changes to the existing treaty the UK inherited from the EU. However, it contains brand new clauses which place the “free flow of data” between the UK and Japan, and from there on to other trade partners, over and above data protection rights.

Assuming that the UK simply recognises data protection as “adequate” in January, current restrictions on European data to stop lightly regulated transfers to the USA, would disappear.

A “free flow of data” approach would be a radical departure from the current position. Today, UK companies must only transfer your personal data where they can guarantee that you continue to have similar rights over access, correction and deletion of that data. The UK-Japan agreement would force the UK to accept lower data protection frameworks, including voluntary self-regulation, as compatible with the UK’s world leading privacy framework, in Article 8.80 and 8.84.

The UK-Japan agreement, together with the UK adequacy decision, would create a “gateway” for your data to flow to other countries that also have “free flow of data” trade arrangements with Japan. Worryingly, this will permit UK data to be transferred to the USA, without it being kept under GDPR-style protections.

Once data is exported from the UK to the USA via Japan under this agreement, your rights would effectively cease. There is no longer any right for you to know where the data is held, or by whom; you cannot prevent resale, reuse, or the data being put to new uses. There is no right to prevent your data from being used in ways that are discriminatory, or unfair. You cannot ask for your data to be deleted. If it is lost, then there is no legal barrier to a third party from obtaining it and using it. And there is no simple recourse to you if your data is breached or sold.

Under this mechanism, data transferred — or “laundered” — from the UK to Japan, and then onwards, could be abused more or less how a company or individual wishes.

The UK Government could attempt to impose restrictions against the flow of data to the USA. However, it seems very unlikely that the UK Government would try to impose restrictions, as these would appear to violate the terms of the Trade Agreement it has just negotiated. This will be a decision of the Executive, not the ICO, made with very limited consultation.

It is likely to prove impossible for the EU to conclude a data protection adequacy decision for the UK while these unrestricted data flows with Japan, and its trade partners are in place. The EU specifically excluded data flows from their trade agreement with Japan. Although Japan has an adequacy decision from the EU, it had to put specific arrangements in place for EU data to stay in Japan.

This stopped the data of people in the EU — including the UK — from being shifted to an overlapping legal regime and freely siphoned off to third countries. This trade deal bypasses both of those safeguards.

The EU could ask the UK to mirror the arrangement with Japan, and “segregate” EU data and ensure it does not flow onwards to the US. However, this would create a large bureaucratic overhead for UK businesses trading with the EU. And it does nothing to protect UK citizens from seeing their data misused under US law.

It is unacceptable for the UK to shift from the high levels of data protection we currently enjoy to a data free-for-all through obscure clauses in a trade agreement. Parliament must demand answers, and ensure the Government “freezes” these clauses from the treaty.

Freezing controversial clauses has precedents — the same occurred with the IP chapters of the Trans Pacific Partnership (TPP). It is easy enough to do and would not affect other sections of the treaty. The ongoing economic relationship between the UK and Japan does not need these rushed provisions with seismic ramifications. It is in Parliament’s hands to make that happen.

(Contribution by Heather Burns, ORG’s Policy Manager, and Jim Killock, ORG’s Executive Director)

The article was first published on ORG.