International Data Transfers Expert Council new report: recommendations for a sustainable and scalable approach to international data transfers

The Council

The Council was established by the UK Government in January 2022 to provide independent advice on responsible and trusted personal data transfers alongside the maintenance of high standards of data protection and cross-border protection of citizens' rights. The Council is comprised of experts from a range of backgrounds both from the UK and worldwide, including data and privacy, not-for-profit, academia and law and includes Vivienne Artz, OBE, the keynote speaker at the 2023 DACB Data, Privacy & Cyber Conference.

The Report contains the Council's recommendations to the UK Government and the international community on personal data transfers. It arose from the work, research and meetings of the Council which have taken place over the past 18 months since its inception. The Council's depth of cross-industry experience influenced the preparation of the Report, with the intention being that it captures discussions between Council members focused on their own areas of expertise.

The Report and its recommendations

The Report identifies numerous challenges with the current approach to international data transfers. A lack of central governance body, leadership and collaboration is among the issues discussed. Also highlighted is how existing multilateral organisations in the field do not go far enough to address the wider fragmentation in the existing governance landscape. The Report further stresses the danger of a 'data blocs' scenario due to declining multilateralism and increasingly diverging standards. Case studies are used to demonstrate these challenges, for example, the UK's Covid-19 response and the war in Ukraine.

The Report sets out key characteristics to underpin a sustainable solution to these problems, namely an approach which: has strong political endorsement; is risk-based, accountability-based; interoperable and outcomes focused; consists of multiple mechanisms; follows incentive-based enforcement; and is scalable. These features form the foundations of the Report's recommendations (which are not necessarily all to be advanced simultaneously):

1. The UK should further advance its unique position and provide global leadership to resolve global challenges related to international data transfers, driving stability to enable the benefits of international data transfers while emphasising strong, outcome-oriented protections.
2. Build upon current momentum around trusted Government access to personal data held by the private sector.
3. Champion the growth and expansion of organisational accountability as a basis for trustworthy international data transfers.
4. Engage in standards work to operationalise international data transfer protections clearly.
5. Pursue an active multifaceted international strategy to encourage discussion of the topic in relevant multilateral fora.
6. Complement multilateral work with focused bilateral engagement on transfers of personal data transfers internationally.
7. Contribute to shaping the evolving approach and design of the governance of the Global CBPR system, with a view to making it a more meaningful and widely accepted basis of a true multilateral solution.
8. Continue to dedicate resources to solving challenges in international data transfers.

Key takeaways and next steps

There is a clear focus in the Council's Report on a need for a multilateral, international strategy to data transfers, focusing on co-operation and engagement. The Report is non-binding, containing recommendations for the UK Government to consider and respond to. Ultimately, it is a springboard for further discussion in this area, and the Council intends on continuing its close work with the UK Government to take forward the actions and recommendations in the Report and generate ideas and proposals for an implementation plan.