On 8 June, U.K. Prime Minister Rishi Sunak and U.S. President Joe Biden announced the Atlantic Declaration: A Framework for a Twenty-First Century U.S.-UK Economic Partnership. It is the latest, most high level (it doesn’t get higher) and most conclusive development in the development of a comprehensive U.S.-U.K. partnership on data and artificial intelligence.
Data
Sharing data across borders is a fact of life for all organizations doing businesses or operating internationally. Yet, doing so in compliance with privacy laws has become one of the most vexing and complex issues for organizations of all stripes and sizes.
Beginning with the Snowden disclosures from 10 years ago and reaching its latest crescendo with record-breaking EU General Data Protection Regulation enforcement against Meta, there has long been regulatory instability and uncertainty associated with transferring personal data to the U.S. Today, with new and improved U.S. laws and practices that enhance privacy safeguards in the national security and law enforcement context, both the U.K. and the European Union are poised to finalize regulatory arrangements (a “data bridge” and “adequacy” decision, respectively) that endorse U.S. standards and thereby provide organizations with a streamlined and cost-free route to transfer data to the U.S.
A data bridge with the U.S. has been a top priority for the U.K. government since the U.K. left the EU and was able to negotiate a successor to the Privacy Shield framework directly with the U.S. Before finalizing the arrangement, there is work required on both sides of the pond. The U.K. government will need to seek the advisory opinion of the Information Commissioner’s Office and introduce legislation to the U.K. Parliament.
The U.S. will need to finalize its designation of the U.K. as a “Qualifying State,” whose citizens can get the benefit of enhanced U.S. privacy safeguards, on account of the U.K. having comparable privacy safeguards to the U.S. in the context of national security. The designation of the U.K. as a “Qualifying State” is something that is understood to be straightforward given the U.K.’s record, the EU’s positive assessment of U.K. standards and the existence of common principles and cooperation between the U.K. and U.S. on such matters.
The announcement follows an agreement with South Korea which was finalized last year and gets in front of other ongoing U.K. negotiations with Australia, Colombia, Singapore and the Dubai International Free Zone. With the bilateral U.S.-U.K. negotiations coming to a close, it’s becoming increasingly clear that both countries are looking to double down on their shared desire and joint work to advance the development of a new multilateral data sharing bloc in the form of the Global CBPR Forum, which involves countries like Canada, Japan, Singapore and South Korea.
AI
The velocity associated with the technological development and integration of AI is being matched by AI governance initiatives around the world. There are consultations, draft laws, public-private sandboxes, codes of conduct and regulatory guidelines appearing from Australia to Canada, via Singapore, and many places in-between.
Organizations and professionals tasked with implementing AI safely are calling for clarity on the application of existing guardrails and on the design of new guardrails. The race is on and, in the spirit of data bridges, many countries are linking arms to build consensus and share expertise on how to approach AI governance.
The Atlantic Declaration, which includes White House endorsement of the U.K.’s “comprehensive and balanced” approach to the risks and opportunities of AI, confirms the U.K. will play host to the first international governmental summit on AI safety in the fall. This latest multilateral push follows initiatives at the G7, OECD, UNESCO, ISO, African Union and Council of Europe.
PETS
Privacy-enhancing technologies are being increasingly cheered on as a paradigm shift to the oft-characterized zero sum tension between privacy and data utilization. PETs can help unlock more value out of data, while preserving or even enhancing privacy rights, and are seen as a key component to AI governance.
That the U.S. and U.K. are also cheering on PETs is not new. The announcement in the Atlantic Declaration of a new “Collaboration” on PETs comes fresh from the U.S. and U.K. announcing the inaugural winners of the UK-U.S. PETs prize challenge. While the details of the new collaboration are not yet clear, it will very likely be framed as a which will likely be regarded as key to incentivizing the development of PETs.
Conclusion
The U.S.-U.K. side to the isosceles EU-U.K.-U.S. triangle is often critiqued as the smaller and less consequential side. However, it might be the shortest side in terms of the policy divide on the role of data, AI and the governance of both in society and the economy. The Atlantic Declaration says as much for U.K.-U.S. cooperation as it does for both countries shared designs to open up that trans-Atlantic triangle, on both data transfers and AI governance, to a more scalable multisided international approach.
