The report from the think tank and UCL European Institute, ‘The cost of data inadequacy’, assesses the economic impact of the UK failing to maintain the current system of personal data flows with the EU after the end of the Brexit transition period on 31^st December.

Modelling prepared for the report estimated that the aggregate cost to UK companies of no adequacy decision would likely be between £1bn and £1.6bn, as a result of additional compliance measures such as setting up standard contractual clauses (SCCs) to continue transferring data from EU countries to the UK.

To calculate the estimate, the report authors derived the average cost of compliance for an average micro, small, medium, and large company, based on estimated costings of data protection impact assessments produced by the European Commission.

The report, which includes interviews with over 60 legal professionals, data protection officers, business representatives, and academics from the UK and EU, also found that failure to reach an agreement on adequacy would lead to implications including:

• Increased risk of GDPR fines, due to new compliance requirements
• Reduction in EU-UK trade
• Reduced investment
• Relocation of business functions, infrastructure, and personnel outside the UK.

One of the recommendations made by the report is that the government should make data and modelling tools available to support empirical research on the social and economic impacts of data protection, digital trade and the value of data flows.

It should also further explain how changes to the UK’s data protection regime, outlined in the National Data Strategy, will strengthen the rights of UK and EU citizens.

The report also said the government should consider the impact of future trade agreements on data protection.