On 19 February 2021, the European Commission (EC) published two draft adequacy decisions for the transfer of personal data to the UK, one under the GDPR and the other under the Law Enforcement Directive.
Once adopted, they will allow personal data to be transferred from the EU/EEA countries to the UK without the need for additional protections (including Standard Contractual Clauses or Binding Corporate Rules).
Background
The United Kingdom left the European Union (EU) on 31 January 2020. Under the Withdrawal Agreement ratified by the EU and the United Kingdom, a transitional period during which EU law continued to apply in the United Kingdom ended on 31 December 2020.
Under the Trade and Cooperation Agreement signed by the EU and UK on 30 December 2020 (Trade Deal), it was agreed that businesses can continue to transfer personal data from the EU to the UK for a maximum period of 6 months or until an adequacy decision is reached, whichever is the earlier.
What is an adequacy decision?
An adequacy decision is a confirmation by the EC that the relevant country ensures an adequate level of data protection. Adequacy decisions have been issued for a number of countries including Israel, Japan, Canada, New Zealand and Jersey (to name but a few).
Approval procedure
The publication by the EC of the two draft decisions is the beginning of a process towards their adoption. This involves obtaining an opinion from the European Data Protection Board as well as approval from a committee consisting of representatives from the EU Member States. Once this procedure has been completed, the EC will adopt the two adequacy decisions.
When adopted, the adequacy decisions will last for 4 years. However, the EC will monitor, on an ongoing basis, relevant developments in the UK to assess whether it still ensures an essentially equivalent level of protection. Where the EC believes that an adequate level of protection is no longer ensured, it will inform the competent UK authorities and may suspend, repeal or amend the decisions.
Watch this space
As the current arrangement under the Trade Deal expires on 30 June 2021, it is hoped that the EU will swiftly complete the process.
The UK has accepted that UK personal data can flow to EU/EEA countries without the need for additional protections and so, the adoption of the two adequacy decisions by the EU will be the final piece in the post-Brexit data transfer puzzle.
For more information, please contact Maureen Daly or any member of the data protection team.