The much-anticipated adequacy decision is finally here – but was it worth the wait?

On 28 June 2021, the European Commission formally recognised the UK’s data protection law as adequate in relation to both the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED). This comes after almost a year of assessment and discussion between the EU and the UK. This decision allows for the free flow of personal data from the European Economic Area (EEA) to the UK and shall provide the same protection provided by the interim regime under the EU-UK Tade and Co-operation Agreement, which expired on 30 June 2021. Whilst the decision is welcome, there are some key limitations and points for businesses to consider going forward which we discuss below.

Adequacy Decision

An adequacy decision is a status granted by the European Commission to countries outside the EU/EEA that demonstrate a similar level of protection in respect of personal data comparable to that provided by European Union law.

The European Commission’s 93-page report provides a detailed assessment of democracy in the UK as well as the UK’s data protection laws. Ultimately the report found that the UK regime closely mirrors that of the corresponding rules applicable within the EU. Such a decision was largely expected after the UK sought to implement equivalent EU rules in national law after leaving the EU and the European Commission’s draft adequacy decision back in February 2021.

For businesses, this is a welcome sign as it allows for the free flow of personal data and EEA based businesses will not be required to take adopt additional mechanisms when transferring data such as the adoption of Standard Contractual Clauses. Businesses can also breathe a sigh of relief given that the adequacy decision was made just two days prior to the expiry of the interim regime under the EU-UK Trade and Co-operation Agreement, meaning that no changes to current arrangements are required.

Points to consider

There are some key provisions detailed within the adequacy decision which businesses ought to be aware of going forward. Didier Reynders, Commissioner for Justice, said: “The Commission will be closely monitoring how the UK system evolves in the future and we have reinforced our decisions to allow for this and for an intervention if needed”.

Therefore, whilst the adequacy decision allows for the free flow of personal data, this will be closely monitored by the European Commission. This is re-enforced by the inclusion of the ‘sunset clause’ which strictly limits the duration of the adequacy decision. The decision will automatically expire after four years and a review will need to be made at the time to determine whether the adequacy decision is renewed. However, this four-year period is not guaranteed and the adequacy decision includes provisions which allow the European Commission to suspend, repeal, or amend the decision if it considers that an adequate level of protection is provided.

Businesses should be mindful going forward that whilst the adequacy decision provides for the free flow of personal data between the EEA and the UK, this is not guaranteed and will largely depend on the UK’s approach going forward. Divergence has already been shown in areas such as immigration control in light of a recent Court of Appeal judgement (R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800) which ruled that the immigration exemption in paragraph 4 of Part 1 of Schedule 2 of the DPA 2018 is unlawful. This resulted in immigration control being excluded from the scope of the GDPR adequacy decision and should further divergence occur, it is likely that the adequacy decision will be amended (or repealed if needed) to reflect this.

How can we help?

We are on hand to assist clients with any queries they may have in relation to the international transfer of personal data, so please do not hesitate to contact our specialist Data Protection and Cyber Security team.

This article was co-written by Haris Saleem, Trainee Solicitor.

Latest updates from @MacRoberts

  • Huge congratulations to Rebecca Cox in our Corporate Finance team who has been shortlisted for the Rising Star of t… 1 hour ago
  • MacRoberts is delighted to be shortlisted at this year’s Scottish Legal Awards! We're up for Firm of the Year & t… 19 hours ago
  • Have you and your partner been considering moving in together? Are you aware of the legal implications that this ma… 29/07/2021
  • Following a consultation in 2019, the UK Government has outlined its intention to introduce a mandatory duty on emp… 29/07/2021
  • Our award-winning Family Law team can help you and your partner through difficult situations by providing support w… 27/07/2021
  • To celebrate the Olympic Games in Tokyo, we're delighted to launch our latest sporting challenge in support of our… 23/07/2021
  • MacRoberts is recruiting! We are currently looking for a Real Estate Planning Solicitor to join the MacRoberts tea… 23/07/2021
  • The countdown is on! With just 100 days to go, we’re looking forward to #COP26 in Glasgow! ♻️ As a firm accredite… 22/07/2021
  • Has lockdown led you to consider a move to the countryside? From discussing a possible purchase to obtaining the… 22/07/2021
  • Have you seen our latest vacancies? 💼 We currently have opportunities in various departments across the firm. Fin… 21/07/2021
  • Acas has published new guidance for employers with helpful information on #flexibleworking & #hybridworking. With t… 20/07/2021
  • Busting the myth that a career in law is only for the privileged few: @marikaflawyer is speaking at this morning’s… 19/07/2021
  • MacRoberts is recruiting! We are currently looking for a Support Services Assistant to join our team in Edinburgh.… 16/07/2021
  • MacRoberts is pleased to have been part of the team advising @HV_Systems in its £5m capital boost from Beehive Equi… 15/07/2021
  • MacRoberts is recruiting! We are currently looking for a NQ Solicitor to join our Conveyancing & Private Client te… 14/07/2021