Do you know where your data flows?
During the Ice Age, about 10,000 years ago, there was a river. It flowed along the line of the River Thames, through the locations of what would become Oxford and London, Canary Wharf and Canvey Island. And then, because it was the Ice Age, and the sea levels were much lower, it kept on flowing, into what is known as Doggerland, the land that is now covered by the North Sea.
The “Proto-Thames” (probably) flowed into a confluence with two other rivers, at a point somewhere roughly equidistant between the location of modern London and the location of modern Amsterdam. These other rivers came from what is now northern Belgium and the Netherlands. In turn, now flowing downstream of this meeting point and following roughly the line of the middle of the English Channel, this larger river merged with still others, flowing from the high ground of northern France and Brittany, as well as the West Country of England and Ireland. As a result, it would have been possible to row, in a coracle or a hollowed-out canoe, from Oxford to Ostend, from Abingdon to Amsterdam, from Faringdon (or indeed Farringdon) to Flanders. There was no barrier to stop this flow, of water and of people navigating it, between the Cotswolds and Champagne.
And then, one day, the ice started to melt. Any change was gradual for many years, until suddenly, around 8,200 years ago, the low-lying rivers were literally inundated; a huge ice wall gave way, spewing meltwater into Doggerland, followed soon after by a massive underwater tsunami off Norway. Suddenly, a massive barrier split this ancient river system apart, and what would become Great Britain was cut off from the rest of Europe. And now, most of this Palaeolithic network is invisible to all but the hungry cod or the keenest of deep-sea divers; technically, it would be possible to follow the routes of these river banks, but they are buried underneath billions of gallons of saltwater.
Apologies for the slightly ham-fisted and somewhat obvious metaphor, but now there is a similarly invisible network flowing vitally important particles across Europe, including Great Britain – that of data. For the time being, it’s possible to flow your data, metaphorically, between Cheltenham and Cologne, but the great deluge to cut off this connection is about to hit. There are a few things you can do, however, to mitigate against this potential, if imminent, risk, and now is the time to do so.
Whatever the right or wrongs of it, and whether you wanted it or not, we all need to plan for a post-Brexit European environment. The UK is one of the most advanced data economies in Europe, and is a leading light in terms of how to pioneer through using data, and the ICO is one of the leading data regulators in the world. The ability to flow data from one server location to another is a crucial part of this landscape. However, because it is invisible – certainly compared to the movement of goods or food produce – it hasn’t grabbed the attention of industry as much as other areas of Brexit planning.
But just because you can’t see it, it doesn’t mean it doesn’t happen, nor that it isn’t very important. Without these data flows, much of this part of the economy would freeze up. At the moment, as part of the EU and EEA, data can flow seamlessly from the UK to Europe, a bit like the Ice Age man from Abingdon in his coracle rowing down the river to go to his cousins in Amsterdam. And crucially, the same thing can happen in reverse, so his Dutch friends can come back to Oxfordshire just as easily.
However, a no-deal Brexit is the data equivalent of the ancient Norwegian cliff that is ready to fall and cause a cataclysmic tsunami to cut the UK off from the rest of Europe. At the time of writing, the UK has agreed to allow any data that flows from Europe (whether it’s from customers, or servers, or data lakes, or whatever) to continue to flow in the same way, the EU has not yet reciprocated this agreement.
Which would mean that any data that currently sits in Abingdon (to continue with that metaphor) could not flow to Amsterdam – although data currently in Amsterdam could go the other way (but of course, then it couldn’t go back again!). And so, in the event of no-deal, it would not be possible for data to go from UK servers to European ones.
You may think that would be easily fixed. And it would be very surprising if that equity of data flow – one might almost say a level playing field – would not be part of a last minute deal. But in the event of no-deal, that wouldn’t be the case, and it would require an “adequacy agreement” to be put in place. The fastest one of these has been completed is 18 months, and it could be significantly longer than that. The EU also doesn’t review these agreements very regularly, so there is no guarantee that this would even start particularly quickly.
In the meantime, the data flows from Europe – a huge market for the UK’s data industry – would effectively stop, unless there are specific contractual clauses between the two parties that would guarantee that the data was treated to EU standards whilst being stored or processed in the UK. This could require additional legal effort for data controllers and data processors, both in the UK and across Europe, to put in place.
However, it would also require an understanding of exactly where your data flows are for your business across Europe. Do you know exactly where your data is stored, and, in processing, analysing and using these data, does the information flow between national boundaries? For multinational clients, this is a particular challenge, but it is important to establish your “flow map” so that you can put adequate safeguards in place in the event of no-deal.
Many companies, of course, will have already planned for this, and already undertaken these assessments, although it would be worth checking that scenarios haven’t changed since March. And, as it stands, all of this remains contingency planning, but we are at a point where it’s important to have your map in place so you can navigate the increasingly complex flows should you need to after November.
If you need any assistance with your data flow assessment and drawing up your maps, please get in touch with Station10.