European Commission’s draft adequacy decisions
23rd February, 2021
On 19 February 2021, the European Commission (EC) published draft adequacy decisions in respect of the UK which, if adopted, will allow for continued free flow of personal data from the EU into the UK.
There are two draft adequacy decisions in relation to: (1) the UK General Data Protection Regulation (the GDPR decision); and (2) Law Enforcement Directive (the LED decision).
The GDPR decision
If adopted, this decision will allow personal data to continue to flow freely between the EU and the UK so avoiding the need for cumbersome mechanisms such as the Standard Contractual Clauses to be used. It has been anticipated that the UK would receive adequacy in relation to the UK GDPR as it is essentially the same data protection regime as the EU but this was not guaranteed.
The LED decision
There has been doubt as to whether the UK would obtain adequacy in relation to law enforcement because of the powers of UK intelligence agencies. The Schrems I and II cases in the Court of Justice of the EU found that the US lacked adequate data protection standards and so did the UK’s surveillance regime (from the Investigatory Powers Act 2016).
Our police and criminal justice systems have also been cited as potential issues for the UK in obtaining an LED decision because there is potential remote access to that data (due to the close relationship between the US and the UK).
Therefore, although there is a draft decision (the LED decision), there is still a chance this could be blocked by the Committee on the basis that it undermines the integrity of the personal data of EU citizens where that data is held in the UK.
Approval of the draft decisions
What needs to happen next?
For the decisions to be adopted, two things need to occur: (1) the European Data Protection Board (the EDPB) needs to provide its opinion; and (2) a committee of representatives of the EU Member States (the Committee) must approve in accordance with relevant procedures. There is still the possibility that the adequacy decisions may not be adopted.
What to do now?
For the moment there is nothing you need to do. The “bridging mechanism” agreed in the Trade and Co-operation Agreement between the EU and the UK continues to apply, meaning that personal data from the EU can freely transfer to the UK until the end of June (although there is a possibility the mechanism won’t be extended at the end of April which would mean it would end then). Further information on the Trade and Cooperation Agreement and personal data flows can be found in our update here.
We will let you know when the decisions are adopted (or not). If they are not adopted you will need to move fast to make sure you have an effective mechanism to transfer personal data out of the EU.
Ward Hadaway regularly advises organisations in a variety of sectors on data protection law compliance issues and our team of data protection experts are experienced in dealing with personal data imports and exports. For more details of how we can help you, or for guidance on any of the issues raised above, please get in touch.
Please note that this briefing is designed to be informative, not advisory and represents our understanding of English law and practice as at the date indicated. We would always recommend that you should seek specific guidance on any particular legal issue.
This page may contain links that direct you to third party websites. We have no control over and are not responsible for the content, use by you or availability of those third party websites, for any products or services you buy through those sites or for the treatment of any personal information you provide to the third party.
