EU Commission issues draft data adequacy decision for the UK
Posted on: Friday 19 February 2021 | IAB UK
The news follows constructive discussions between DCMS and the EU, and would allow data to flow freely from EU/EEA to the UK. Article updated April 2021
The draft decision recognises the UK’s high data protection standards and sets out the European Commission’s (EC) decision that the UK’s levels of personal data protection are ‘adequate’. Once confirmed, positive data adequacy decisions under both the EU General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) would allow for personal data to continue to flow freely from the European Union (EU) and wider European Economic Area (EEA) to the UK.
The draft decision, which brings the UK significantly closer to its goal of achieving adequacy status, will now be shared with the European Data Protection Board for a ‘non-binding opinion’, before being presented to EU member states for formal approval. Ratification of the Commission’s adequacy decisions will help ensure that UK businesses and organisations can continue to receive personal data from the EU and EEA without additional compliance burdens or costs. Currently, temporary provisions are in place that were implemented at the end of the Brexit transition period to permit these data transfers to continue, but only for a definite period, pending the conclusion of the adequacy process.
Commenting on the news, Oliver Dowden, Secretary of State for Digital, said:”I welcome the publication of these draft decisions which rightly reflect the UK’s commitment to high data protection standards and pave the way for their formal approval.
“Although the EU’s progress in this area has been slower than we would have wished, I am glad we have now reached this significant milestone following months of constructive talks in which we have set out our robust data protection framework. I now urge the EU to fulfil their commitment to complete the technical approval process promptly, so businesses and organisations on both sides can seize the clear benefits.”
Read more about the current status of data transfers between the UK and EU here.
April 2021 update: EU data adequacy process
As part of the EU’s decision-making process on data adequacy, the European Data Protection Board (EDPB) is required to give an opinion on the draft decision of the European Commission (which was published in February). It has announced its opinion, saying " …the EDPB recognises that the UK has mirrored, for the most part, the GDPR and LED in its data protection framework and when analysing its law and practice, the EDPB identified many aspects to be essentially equivalent". The EDPB has stated that it has no objections to the EC’s draft decision to grant adequacy and supports the EC’s decision to apply time limits to any adequacy decision, as well as its intention to closely monitor developments in the UK that might affect its alignment with the GDPR.
The next stage in the process is for the EU Member States to ratify the decision before it can then be formally adopted. Indications are that the process will be concluded by end of May/beginning of June, which would be in time to meet the 1 July deadline, the latest date on which the current transitional arrangements for EU-UK data transfers expire. Those arrangements were in place for 4 months from January, i.e. to 1 May, but can be extended by a further 2 months if no adequacy decision has been made by that time (and there are no objections on either side, which is not expected).
The expectation is that the EC’s will come into effect, but organisations are still advised to put in place alternative legal mechanisms for the transfer of data as a sensible precaution.
Brexit Deal: Summary & guidance
Explore the business support available post-Brexit and review the Government’s six-point checklist for companies that trade with the EULearn more
What does Brexit mean for data transfers?
Following the end of the UK’s Brexit transition period, what does our new agreement with the EU mean for the transfer of data?Learn more
Brexit Negotiations: Endgame
With six months left until the end of the transition period, we look forward to the potential sticking points and breakthroughs that we might encounter... Learn more
How to get your business prepped for Brexit
With 31 October looming and continued uncertainty around a Brexit deal, make sure you’re doing everything you can to prepare your company for the UK’s EU...Learn more