On 19 February, the EU Commission published two draft adequacy decisions for the transfer of personal data from the EU to the UK. One relates to the GDPR1 and the other to the Law Enforcement Directive2.
The next steps are an opinion from the European Data Protection Board and the ‘green light’ from a committee of EU Member State representatives. Then, the EU Commission may adopt the adequacy decisions. This would mean that the UK would be deemed a ‘safe’ country for the purposes of data transfers, meaning that no additional safeguards need to be put in place for transfers of personal data from the EU to the UK. Though, of course, other data protection rules would still apply to the transfers.
Interestingly, the EU Commission has indicated that the decisions would be valid for a period of four years and could then be renewed. This is on the basis that UK data protection law is currently based on EU law, but, having left the EU, the UK now has the freedom to depart from EU rules. The adequacy finding could be renewed if the UK regime continues to be adequate following the initial four years. The EU Commission has also noted that the UK continues to be a party to the European Convention on Human Rights, and ‘Convention 108’ of the Council of Europe (relating to data protection).
Currently, additional safeguards are not required for transfers from the EU to the UK due to an interim regime of four to six months agreed from January 2021 in the EU-UK Trade and Cooperation Agreement (following the end of the Brexit transition period). In order for EU to UK data flows to continue without additional measures, the adequacy decisions would need to be adopted before the end of this interim period.
The EU Commission press release and draft decisions are available here.
Olivia Whitcroft, principal of OBEP, 22 February 2021
This article provides general information on the subject matter and is not intended to be relied upon as legal advice. If you would like to discuss this topic, please contact Olivia Whitcroft using the contact details set out here: Contact Details