Draft UK adequacy decision finally announced
Author: Lowri Morgan-Macdonald
On 19 February 2021, the European Commission finally announced a draft adequacy decision in respect of the UK. This represents a long-awaited and essential step in ensuring that personal data can continue to flow freely from the EU to the UK following the UK’s exit from the EU.
By way of background, from 1 January 2021, the UK is considered a third country for the purposes of the EU GDPR which means that an EEA organisation can only transfer personal data to the UK if it is covered by either (a) an adequacy decision; (b) appropriate safeguards (such as standard contractual clauses); or (c) one of the limited exceptions.
An adequacy decision is where the European Commission approves the legal framework in the country, territory, sector or international organisation to which the personal data is to be transferred as providing adequate protection for the rights and freedoms of individuals in respect of their personal data.
It was hoped that the European Commission would reach an adequacy decision in respect of the UK prior to the end of the transition period, particularly as UK data protection laws are currently essentially in alignment with the EU GDPR in any case.
However, the European Commission failed to do so prior to 31 December 2020, which led to the UK and EU having to negotiate and agree a so-called ‘bridge’ as part of the EU-UK Trade and Cooperation Agreement which was reached on Christmas Eve. The bridge allows the free flow of personal data from the EEA to the UK to continue following the end of the transition period until either a UK adequacy decision is reached by the European Commission, or until 30 June 2021, whichever comes first.
Now that a draft adequacy decision has been announced by the European Commission, it will be shared with the European Data Protection Board for a non-binding opinion before finally being presented to EU member states for their formal approval.
The UK has strongly encouraged the EU to complete the final approval process as soon as possible so that data can continue to flow freely between the EU and UK.
For more information or advice on the above or if you have any further questions, please contact Lowri Morgan-Macdonald (lowri.morgan@acuitylaw.com) who will be happy to assist.
