On 19 February 2021, the European Commission published its draft data adequacy decisions in favour of the United Kingdom in relation to both the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED). Data adequacy is a status granted by the European Commission to countries outside of the EU/EEA that demonstrate a level of personal data protection comparable to that provided in European law. An EU adequacy decision in favour of the UK would allow the international transfer of personal data from the EU/EEA to the UK, without EU/EEA based organisations needing additional safeguards to comply with their obligations under the GDPR and LED.
The draft from the European Commission is welcome news for organisations that transfer data across European borders into the UK. It is hoped that the draft will materialise into a concrete decision before the end of June, to avoid the UK being considered a “third country” for GDPR purposes. Responding to this development, the Information Commissioner remarked that: “The draft adequacy decisions are an important milestone in securing the continued frictionless data transfers from the EU to the UK”.
The UK has demonstrated a commitment to data protection via its reflection of the GDPR’s provisions within national legislation. The UK data processing regime now consists of the Data Protection Act 2018 and the UK GDPR, which combined mirror almost identically the GDPR and LED. These have likely influenced European Commission decision making in the UK’s favour.
While it is not a forgone conclusion, the draft decision is an important indicator of the European Commission’s intentions. The next step involves obtaining approval from the European Data Protection Board (EDPB), and the European Commission will then seek confirmation from Member States' representatives, after which the adequacy agreement will be formalised. Once implemented, the adequacy decision will be reviewed every four years and extended on a rolling basis provided there is no later divergence between the EU and UK regimes. The UK Government has, however, expressed some frustration with the pace of progress, urging the EU to “swiftly complete the technical process for adopting and formalising these adequacy decisions as early as possible”.
Currently, EU/EEA to UK transfers of data are operating under a bridge scheme legislated for in the UK-EU Trade and Cooperation Agreement (TCA). This scheme extends the free flow of personal data between the EU/EEA and the UK for up to six months, ending at its latest on the 30 June 2021. It has facilitated the free flow of personal data from the EU/EEA to the UK without additional compliance measures such as Standard Contractual Clauses.
How can we help?
Our Data Protection and Cyber Security team is on hand to assist clients with any queries they may have in relation to the international transfer of personal data, so please do not hesitate to contact us.
