UK small businesses face crippling costs unless the UK can show the EU that it has adequate levels of data protection, according to research from UCL’s European Institute and the New Economics Foundation.
The Cost of Data Inadequacy is the first major report to look at the impact on business and the economy if the flow of data between the EU and the UK is disrupted because of the lack of an ‘adequacy decision’. It puts the overall cost of that scenario to British companies at between £1bn and £1.6bn.
Data adequacy decisions, in which the EU certifies that a country has the appropriate level of data protection, are essential for everything from enabling online shopping to powering research collaborations.
In the event of a no-deal Brexit, or a deal but then no adequacy decision, small and medium-sized firms will be disproportionately affected by the disruption. The average compliance cost estimated at £3,000 for micro, £10,000 for small, almost £20,000 for medium and about £163,000 for large businesses.
Oliver Patel, Research Associate at the UCL European Institute said: “In recent years, the European Court of Justice has taken a much tougher approach to restricting data transfers between the EU and other countries, much to the consternation of the business community. Post-Brexit, there is a risk that EU-UK data transfers could be targeted by activists and European courts, seeking to exploit the rigid EU rules in this area”.
Duncan McCann, senior researcher at the New Economics Foundation, said: “Failing to secure an adequacy decision will impose additional costs on UK organisations of over £1bn, disproportionality falling on SMEs, at a time when the economy is already severely challenged by the pandemic and trading conditions are difficult.
“A positive adequacy decision eliminates these costs, as well as others risks, and ensures that the UK remains an easy and attractive place for EU organisations to share data with, especially in data intensive sectors of the economy.”
The report says the costs of legal fees and bureaucracy would deprive businesses of vital resources and investment in new technology, staff, and research at a critical time. Financial services, digital technology companies and data centres are likely to be worst hit.
The research draws on extensive interviews with legal professionals, business representatives, data protection officers and policy makers, from the UK and the EU.
One business contributor quoted said, “It may be easier to just move out of London and open an office in Frankfurt or Dublin,” while a technology business executive predicted, “Over time, EU companies will prefer to keep data in Europe.”
A recommendation in the report is that the government should bolster support and guidance for businesses to manage the cost of complying with EU data transfer rules after the Brexit transition period, in the event that an agreement is not reached.
Links
- The Cost of Data Inadequacy: the economic impacts of the UK failing to secure an EU data adequacy decision
- UCL European Institute
- New Economics Foundation
This article was first published on 23 November by UCL.
Receive the Funding Newswire each Tuesday, our Policy Bulletin each Thursday, and news about bridging Europe’s east-west innovation gap twice a month in The Widening. 
A unique international forum for public research organisations and companies to connect their external engagement with strategic interests around their R&D system.
