8. In view of the importance of data flows and exchanges across the future relationship, the Parties are committed to ensuring a high level of personal data protection to facilitate such flows between them.
9. The Union's data protection rules provide for a framework allowing the European Commission to recognise a third country’s data protection standards as providing an adequate level of protection, thereby facilitating transfers of personal data to that third country. On the basis of this framework, the European Commission will start the assessments with respect to the United Kingdom as soon as possible after the United Kingdom's withdrawal, endeavouring to adopt decisions by the end of 2020, if the applicable conditions are met. Noting that the United Kingdom will be establishing its own international transfer regime, the United Kingdom will in the same timeframe take steps to ensure the comparable facilitation of transfers of personal data to the Union, if the applicable conditions are met. The future relationship will not affect the Parties' autonomy over their respective personal data protection rules.
10. In this context, the Parties should also make arrangements for appropriate cooperation between regulators.
This looks like both sides want to keep uninterrupted data transfer going.
Will this stymie our ability to cut free trade agreements? More relaxed American standards do seem to be the de facto standards (despite intense EU efforts).
The section in the October PD is identical to the previous Political Declaration. Another area that Cummings scepticism (covered previously on this thread) did not change the terms.
This is very important in the data field as if the UK does not get an adequacy declaration by the time we leave the transition period then there will be an in practice limited number of ways in which EU companies can share data with the UK, and one of these is Standard Contract Clauses - which this case is challenging.
The AG's opinion doesn't really seem to challenge this, although it does lay down some more general circumstances than before where the SCCs will become inoperable. This shouldn't really affect the UK. So that's a relief.
However the interesting part is the discussion over government surveillance. Here the EU operates a double standard. Government surveillance of data is not an issue for EU states, under the EU we're simply supposed to ignore it. However it is a matter for sharing outside the EU - and this would apply to things such an adequacy decision.
The AG's opinion is not the final judgement (and we've seen this in a couple of the Brexit related cases) but broadly speaking the CJEU judges do follow the AG's opinion, quite unlike the British adversarial system.
It's a decent summary of the current state of debate that you could find on this thread (although nor with Cummings pre Downing Street hostility to GDPR which is probably missed by almost everyone who hasn't read this thread).
Basically the big reveal is that the EU's adequacy decision us not going to be a rubber stamp mainly due to police access to emails which is not an issue for EU countries. We knew that.
Two interesting new facts. The first is that the Times is reporting that discussions are due to start in two weeks, so before we've left.
The second is that the EU is now explicitly linking an adequacy ruling to the trade talks. Thos should be unsurprising, but as Richard North points out this is a breach of the fairly watertight requirement within GDPR to rule on this solely on technical grounds. But then we are expecting the EU Commission to obey an inconvenient law.
12. In view of the importance of data flows, the envisaged partnership should affirm the Parties’ commitment to ensuring a high level of personal data protection, and fully respect the Union’s personal data protection rules, including the Union’s decision-making process as regards adequacy decisions. The adoption by the Union of adequacy decisions, if the applicable conditions are met, should be an enabling factor for cooperation and exchange of information, in particular in the area of law enforcement and judicial cooperation in criminal matters.
Nothing much in Boris's Greenwich speech, but this was in his written statement to Parliament:
Similarly, the UK would see the EU’s assessment processes on financial services equivalence and data adequacy as technical and confirmatory of the reality that the UK will be operating exactly the same regulatory frameworks as the EU at the point of exit. The UK intends to approach its own technical assessment processes in this spirit.