Data law: keep calm and cry freedom

In the early 15th century, the world’s most advanced maritime nation was China. Its fleets of giant ‘treasure ships’ roamed South Asia, Arabia and East Africa and might have reached the Americas and even Europe via Cape Horn had not Beijing suddenly banned ocean-going. History shows it as a colossally ill-timed decision. 

Explanations for why China turned inward fill many academic bookshelves, but my guess is that the emperor simply decided that the exploration game was not worth the candle. China was evidently the centre of civilisation; barbarians wanting to do business with it should travel at their own expense and work by the middle kingdom's rules. 

Of course I'm trying to make an analogy with Brexit. But not, I hope, the obvious one. My fear here is not of the UK turning inward - catastrophic as that would be - but that the EU as a whole is doing a 15th-century China, and that in our anxiety to preserve the single market, we will be part of it. 

Just as oceanic shipping was the technology which underpinned the unprecedented explosion in wealth and freedoms that began in 15th-century Europe (albeit stained along the way by the slave trade and the extinction of people such as the Incas) so the manipulation of data about individuals has emerged as the motor of 21st-century economic growth. But it's not happening in Europe.

Rightly, in its efforts to set up a digital single market, the European Commission laments the lack of a European Amazon or Google. But its approach to filling the gap is a little quixotic: the general data protection regulation. The measure, to come into force in May 2018, introduces a raft of rights for data subjects and responsibilities for data owners, including fines of up to 20m euros for breaches. (Bird & Bird has a very readable beginners' guide here.) 

Unsurprisingly, most post-referendum commentary seems to be a tizz about whether UK businesses would continue to be bound by the regulation. The assumption is always that we need to take it on board to preserve access to the single market. 

The European Commission's approach to filling the gap is a little quixotic

With commendable honesty, the minister responsible, Lady Neville-Rolfe, admitted this week she hasn’t a clue, saying 'we need to consider carefully what might be done either to replace it if and when it ceases to have effect or, instead, if in the event it never comes into force'.

One option that might be considered is to ignore it. This is a regulation created by an economy which, by its own admission, is not a player in the global online world. The dream, of course, is to create a walled garden for European internet start-ups. But I suspect that the next Amazon or Google emerging from the hothouse fusion of artificial intelligence, big data and the unravelling of the human genome won't be assisted by a regulatory regime quite out of step with that of the rest of the world.  

Lawyers - and some of my best friends - will scream 'what about my business with the rest of the EU?'. Yes, doing business in the single market will still require some form of 'safe harbour' data protection deal to replicate the reach of GDPR, but my gut feeling is that the online economy that will matter in the future is with the rest of the Anglosphere – north America, India and Bangladesh, Australasia and Africa. 

Perhaps Europe has it right. Perhaps the rest of the globe will adjust its rules to pay tribute and do business to the world's only declining trading block. But if would be foolhardy for the UK to bet its future on that, if it has the choice. 

The barbarians did come to China in the end. But bringing their own laws, languages, religions – and guns. 

Michael Cross is Gazette news editor