Keeping data flowing across the Channel could get much trickier than the U.K.'s position paper suggests | Boris Reossler/EPA Brexit Files Insight UK’s data flows under EU surveillance The Brits want data protection rules to stay the same after Brexit. But there’s a catch.

On the face of it, data protection is one of the least controversial areas in the Brexit negotiations — but there are problems ahead.

At stake is whether U.K. companies with customers, users or employees in the EU can transfer personal data like family pictures, banking details, employee payslips and addresses once Brexit happens. A disruption of data flows could mean billions of euros in costs for companies.

The U.K. in its position paper, released Thursday, is saying it wants everything — pretty much — to remain the same. For months, British government officials and watchdog bodies have made clear that they like the way the EU deals with the protection of online privacy. Downing Street is also pushing a new bill to align their laws with the EU's strict General Data Protection Regulation.

The Brits would even like their information commissioner to continue to play a role in EU regulatory structures post-Brexit.

However, there is a catch.

The U.K.'s beefed-up surveillance law — the Investigatory Powers Act, which came into force at the end of last year — seems to violate EU fundamental rights and will cause problems for any eventual arrangement on data flows post Brexit.

The law, which was the brainchild of Prime Minister Theresa May when she was still at the Home Office, allows the U.K. government to surveil large batches of data, collect people's browsing records and hack citizens' phones and computers to maintain security.

The EU's highest court — the European Court of Justice in Luxembourg — gave the U.K. a stern slap on the wrist in December for what it regards as the excessive powers granted to security services. And the European Commission is seeking assurances from the U.K. that these powers won't be abused.

"What the U.K. needs to do is convince the Commission — and perhaps one day the European Court of Justice — that the Investigatory Powers Act is compatible with fundamental rights. That's a tall order," said Eduardo Ustaran, partner at law firm Hogan Lovells in London.

Keeping data flowing across the Channel could get much trickier than the U.K.'s position paper, published Thursday, suggests.

This insight is from POLITICO's Brexit Files newsletter, a daily afternoon digest of the best coverage and analysis of Britain’s decision to leave the EU. Read today’s edition or subscribe here.