I thank the noble Lord, Lord Stevenson, and the noble Baroness, Lady Ludford, for this amendment, which seeks to add additional scrutiny to the data adequacy assessment process by introducing a bespoke statutory reporting requirement. It has certainly been very useful in drawing attention to the importance for both the UK and the EU of the UK pursuing and obtaining positive data adequacy decisions to enable the free flow of personal data after we exit the EU. It is also helpful that the noble Lord highlighted the success of our tech sector, which I thoroughly echo. I am sure that my noble friend the Secretary of State shares that view.
The free flow of personal data is an important feature underpinning the UK and the EU’s future relationship for economic and security purposes. The UK is currently a global leader in strong data protection standards, and protecting the privacy of individuals will continue to be a priority. The noble Baroness, Lady Ludford, referred to a lack of ambition. I do not think there is any lack of ambition on the part of the Government in this area. The Data Protection Act 2018 strengthened UK standards in line with the EU GDPR and law enforcement directive, providing a unique starting point for these discussions. The UK is ready to begin the adequacy assessment process and we are pleased that the EU has committed, in the political declaration, to the Commission beginning its assessment of the UK as soon as possible after our withdrawal, endeavouring to adopt adequacy decisions by the end of December 2020.
Before I try to answer some of the questions posed, I hope it will be helpful to touch briefly on some of the preparation that has been going on in government for the last two years for this eventuality. The Government established a data adequacy negotiation hub which sits within the Department for Digital, Culture, Media and Sport. It was set up early in 2018 and includes experienced experts in both data protection and negotiation. They are ready and waiting and keen to start negotiations with the Commission now.
This amendment would introduce a bespoke statutory reporting requirement, as we heard, covering the assessment period. However, as we heard very eloquently from my noble friend Lord Callanan earlier, there is a need for flexibility of reporting during what will be at times, I am sure, sensitive negotiations. While the Government are absolutely clear in our responsibilities to keep Parliament updated on that progress, and that obviously includes your Lordships’ House, we do not believe that such a rigid regime is appropriate. Obviously, both Houses have an array of tools at their disposal to scrutinise the Government, including through their Select Committees: I refer to the recent report of the Lords EU Committee, which scrutinised the revised withdrawal agreement and political declaration and concluded that the provisions on data protection were to be welcomed.
In this context, we believe there is no need for further bespoke reporting requirements for data adequacy, particularly as setting these out in legislation may have unintended consequences, as was discussed earlier this afternoon. I shall now try to address some specific points, but I am very grateful to the noble Lord, Lord Stevenson, for his offer that I might write to cover some of them.
In a sense, both noble Lords asked about the spirit which would underpin our approach to moving forward in these negotiations. Our aim is to try to find the right way to safeguard privacy while both promoting trade and innovation and protecting citizens from crime and terrorism. All those things are crucial to fully realising the opportunities from the data economy.
8.45 pm
Both noble Lords asked how the Investigatory Powers Act might impact on our ability to achieve adequacy. We are confident of the standards included in that piece of legislation. We believe it provides unprecedented privacy, redress and oversight arrangements which I know both noble Lords have scrutinised in detail and which strengthen previous safeguards governing investigatory powers. Given the level of existing knowledge between ourselves and the EU of each other’s high data protection standards, we are very well placed to demonstrate that we meet and often surpass those standards.