On 8 June 2023, the UK Prime Minister and the US President jointly announced a commitment to a renewed partnership between the countries, and a framework for economic and diplomatic co-operation (the “Atlantic Declaration”1).
The Atlantic Declaration promises coordinated action on developing and regulating emergent technologies and renewable energy, and enhances co-operation in defence, science and data sectors. Notably, it agrees to develop a framework for a “trusted and secure flow of data” between the countries while “ensuring strong and effective privacy protections”2 (the “Data Bridge”). The Data Bridge is the culmination of UK–US negotiations that started in January 2023, and may mirror the EU–US data sharing framework announced in October 20223.
The Atlantic Declaration envisages a UK–US partnership to effect an “inclusive and responsible digital transformation”, comprising three key areas of collaboration: (i) developing a Data Bridge, (ii) regulating artificial intelligence and (iii) developing privacy-enhancing technologies.
The object of the Data Bridge is to make data transfers simpler without sacrificing data security in order to catalyse innovation in both countries. The proposals will be complemented by the Global Cross-Border Privacy Rules and the Organisation for Economic Co-operation and Development’s (OECD) personal data declaration4.
The brevity of the Atlantic Declaration is contextualised by a simultaneous policy notice published by the UK Department for Science, Innovation & Technology (the “Notice”)5.
The Notice elaborates on plans for the Data Bridge to:
- Establish a robust and reliable mechanism for UK–US data flows.
- Uphold the rights of data subjects.
- Facilitate innovation.
- Make services more accessible to people and companies.
- Reduce the burdens on companies when sharing data.
Implementation of the Data Bridge is dependent on the UK being designated as a “qualifying state” under Executive Order 14086 (which announced enhanced US data protection measures including necessity and proportionality controls for data gathering activities, and form the basis for the US seeking “adequacy status” from the European Commission in respect of EU General Data Protection Regulation (GDPR))6.
Negotiations between the UK and US are ongoing to determine the detailed scope and implementation of the Data Bridge.
The contributions of Ben Hasson and Sharon Opare are gratefully acknowledged.
1 Policy Paper, The Atlantic Declaration (Downing Street, 8 June 2023).
2 The Atlantic Declaration; §3 Partnering on an Inclusive and Responsible Digital Transformation.
3 White House, Executive Order 14086, 7 October 2022.
4 OECD Declaration on Government Access to Personal Data Held by Private Sector Entities.
5 The Notice is also a bilateral coordination between the UK Secretary of State for Science, Innovation & Technology and the US Secretary of Commerce (LINK).
6 White House, Executive Order 14086, 7 October 2022.
