A step closer to Adequacy: European Commission publishes draft UK Adequacy Decisions
Following the end of the Brexit transition period (31 December 2021), for data protection purposes the UK is considered a ‘third country’ under the EU GDPR. Transfers of personal data from the EU/ EEA to the UK must therefore be subject to ‘appropriate safeguards’ under the EU GDPR unless a specific derogation applies.
As a result of the Trade and Cooperation Agreement entered into between the UK and the EU on 24 December 2020 (the Brexit deal), transfers of personal data from the EEA/ EU are allowed to continue without the need for such ‘appropriate safeguards’ for a period of 4 months commencing from 01 January 2021 , extendable by a further 2 months (Bridging Period).
Has the UK now got an Adequacy Decision?
On 19 February 2021, the European Commission published two draft Adequacy Decisions in respect to the UK. The European Commission concluded that the UK ensures a similar level of protection to the EU for personal data as set out in:
- an adequacy decision under the EU GDPR, for personal data processed other than by the law enforcement sector; and
- an adequacy decision under the EU LED (Law Enforcement Directive), for personal data processed by the law enforcement sector.
What do the draft Adequacy Decisions mean?
If these draft Adequacy Decisions are confirmed and adopted by the European Commission, then personal data can continue to be freely transferred from the EU/EEA to the UK without the need for any additional mechanisms to facilitate the transfer (i.e. ‘appropriate safeguards’). This would allow personal data to flow between the EU/EEA and UK in the same way as when the UK was a member state of the EU. If adopted, both Adequacy Decisions will be valid for a period of 4 years, with the possibility of each being renewed provided the European Commission affirms that they UK continues to provide adequate level of data protection.
This would be a significant relief for UK businesses. The exercise of mapping transfers of personal data, and then implementing ‘appropriate safeguards’ such as standard contractual clauses to facilitate those transfers, would have reportedly cost businesses up to £1.6 billion
What are the next steps?
Before the draft Adequacy Decisions are adopted, there are two further steps the European Commission must take. First, it will need to obtain an advisory opinion from the European Data Protection Board (EDPB). Second, approval is required from a qualified majority of representatives from EU Member States. Once these steps have been completed, the European Commission is free to adopt the draft Adequacy Decisions.
It is unclear how long this process may take. The last time the EDPB provided an opinion in respect to an adequacy decision (for Japan) the process took approximately four months. However, many businesses are hoping these draft Adequacy Decisions are approved by 30 June 2021 (the last day of the Bridging Period) to disruption to them, if any, is minimal.
Expert Brexit legal advice
If you would like to find out more about how your business should navigate the new rules and remain compliant, please contact our team of business solicitors. Call 0117 906 9400 or email email@example.com
 According to research carried out jointly by the New Economics Foundation and the European Institute of University College London. Please see: https://neweconomics.org/2020/11/the-cost-of-data-inadequacy