Brexit ... Tech

By Nikole Kobie

Things move quickly in politics. The draft text of the Brexit withdrawal agreement has landed, bringing with it a swathe of resignations from ministers, another dive in value for the pound, and general chaos.

What's next depends on parliament — prime minister Theresa May potentially faces leadership challenges and a no-confidence vote — but the text as it stands reveals what Brexit could mean for technology.

That is, if you have time to read all 585 pages of it. Here is how the draft agreement will likely impact the UK’s tech industry, how data will be allowed to flow between the UK and the EU, and whether GDPR will remain in place in the UK. (That is if the deal is agreed by European leaders and still stands at the time of the planned November 25 summit).

Data flows

One of the big questions for Brexit is data protection, and the agreement seeks to hold onto the status quo. Scroll through to Article 71 for the text, which says that EU data protection law will continue to cover the UK before and after the transition period, which runs until the end of 2020. That means personal data can continue to flow between the UK and the EU.

"This issue is critical to the tech sector and to every other industry in a modern digitising economy," says Tech UK CEO Julian David in a blog post. Data's the oil that greases tech, and all that.

That doesn't mean that GDPR will continue to apply in the UK post Brexit. Christopher Knight, privacy lawyer at 11KBW, notes that the UK will become a "third state". That means the UK won't be required to apply GPDR and other data laws to "wholly internal situations of processing".

For data flows between Europe and the UK, he notes that the draft "appears to contemplate an adequacy decision for the UK." That is a term designating "third states" whose data protection laws have been officially deemed adequate to handle Europeans' personal data by default, such as New Zealand, Canada and so on.

Knight raises the question of whether an adequacy decision will be in place before Brexit, or if it will come about during the transition period, as suggested by a secondary document, an outline of the "political declaration" released alongside the draft. Either way, data protection rules will stay the same in the near term, which means that data can keep flowing.

"But after Brexit, the UK has the theoretical right to alter how it implements data protection law, and the Withdrawal Agreement is intended to place some limitations on the extent to which the UK is able to do so," Knight adds. "Article 71(3), for example, would prevent the wholesale repeal without replacement of Parts 1-3 of the [Data Protection Act] 2018, but it would not prevent some tinkering around the edges."

Internal IT

It's not only data flows between private companies that are at risk from Brexit — there's plenty of information flowing between the UK and European countries that needs to be considered.

Under May’s plan, the goal is backwards compatibility, so that any changes to the UK's networks or databases or to the EU's won't stop information from flowing (Annex IV).

The UK will not by default have access to any networks, information systems or databases run by the EU (Article 8), though there's plenty of exclusions, including systems to manage customs and taxes, as well as fraud reporting. Those exclusions have time limits that vary from 2021 to 2026, and to access those, we'll have to "reimburse the Union for the actual costs" each year – before losing access altogether.

In Parliament, Labour MP Yvette Cooper asked about one specific example: international crime databases, in particular the Schengen Information System 2. May said that's the subject of future negotiations, and special treaties will likely be required for full data sharing on security and policing, the BBC notes.

Science and engineering

The draft agreement was light on detail when it comes to science and engineering, though the Political Declaration pledged "appropriate arrangements" on space — including satellite navigation, one controversial sticking point — where it's in the parties' "mutual interest". In other words, they'll work it out best they can, if everyone agrees.

The draft deal would see the UK leave the European Atomic Energy Community (Euratom), which regulates nuclear activity, leaving it entirely in British hands to make sure it meets international atomic rules. Nature notes there's no mention of the International Thermonuclear Experimental Reactor (ITER), a major nuclear-fusion experiment in France, and a related test-bed in Oxford, leaving British contributes and EU funding in question.

The Campaign for Science and Engineering notes that the draft agreement will see the UK treated as a third country for EU programmes and activities, with details of the UK's participation in EU-funded research to be decided later.

Freedom of movement is also closely watched by researchers and the tech industry alike. Under the draft document, EU citizens and their families will be allowed to freely live and work in the UK until the end of 2020, with those who take up residence allowed to stay permanently if they stick around for at least five years.

Research from the Royal Society suggests just shy of a fifth of researchers working in the UK come from the EU.

Of course, whether this draft agreement holds is down to parliament and politics — and even if approved, there's plenty of details for tech and science that remain fuzzy./wired