Progress towards adequacy: European Commission publishes draft adequacy decisions for the UK

Background

On Friday 19 February, the European Commission announced that it had formally launched the procedure to adopt two adequacy decisions for data transfers to the UK. While the decisions have not yet been adopted, it marks significant progress and the possibility of the adequacy procedure being concluded in the coming months.

The UK is currently in the temporary ‘grace period’ or ‘bridge’ for transfers from the EEA to the UK provided for in the EU-UK Trade and Cooperation Agreement, and is seeking an adequacy decision to allow the free flow of personal data to continue. (For more information on the ‘grace period’, please click here.)

Draft Adequacy Decisions

The European Commission has issued draft adequacy decisions for transfers of personal data to the UK in respect of the GDPR and the Law Enforcement Directive. In each, after setting out its detailed consideration the European Commission indicates that it has concluded that the UK has an essentially equivalent (i.e. adequate) level of data protection to that provided for in EU law, which is required for an adequacy finding.

This follows an in-depth consideration of the UK’s domestic law and international commitments (including in respect of the European Convention on Human Rights), and the mechanisms for oversight and redress in place.

This is the first formal step in a process which would mean that, if successfully concluded, personal data could continue to flow freely from the EU to the UK (provided other GDPR obligations are met).

Next Steps

The draft adequacy decisions will next be scrutinised by the European Data Protection Board (‘EDPB’), which will produce a non-binding opinion, and must then be approved by a panel of representatives from the EU Member States. It is currently unclear how long this process will take.

Currently, the grace period runs until the end of April 2021, but may be extended until the end of June 2021. If the GDPR adequacy decision is not adopted by the end of the grace period, businesses wishing to continue to transfer personal data from the EU to the UK will need to consider if they need to provide for appropriate safeguards, including standard contractual clauses, to continue such transfers lawfully.

Outcome

Should the adequacy decision be approved prior to the end of the grace period, it will mean the continuation of frictionless data transfers between the EU and UK. The UK Information Commissioner has welcomed the current development and, if adopted, it would be a relief for many businesses wishing to avoid further expenditure to guarantee ongoing transfers to the UK; however, the story is not yet over and we will wait to see if the decisions are adopted as hoped.