Draft Adequacy Decisions In Favour Of UK Published

On 19th February, the European Commission published draft adequacy decisions in favour of the UK. If the draft adequacy decisions are finalised (a process which could take a few months yet), this will mean that, even though the UK has left the EU, transfers of personal data from the EU to the UK can take place without the need for organisations to put further safeguards in place.

What Is The Current Position?

The UK has already recognised the adequacy of data protection law in EU and EEA member states.

In relation to data transfers from the EU to the UK, at present, there is a temporary bridging mechanism in place (introduced by the EU-UK Trade and Cooperation Agreement). This basically means that, for the purposes of personal data transfers from the EU to the UK, the UK is treated as if it is still a member of the EU. However, this arrangement will only last until the end of June of this year at the latest.

If the bridging mechanism comes to an end without adequacy decisions having been finalised in the UK’s favour, personal data transfers from the EU to the UK would be subject to restrictions. In particular, before continuing with data transfers organisations would need to: :

• carry out a complicated data transfer risk assessment to evaluate whether the personal data in question would be adequately protected in the UK; and
• assuming a transfer is able to go ahead, implement one of the appropriate safeguards provided for in the EU GDPR (such as standard contractual clauses).

What Would An Adequacy Decision Mean?

If the adequacy decisions are finalised, this will mean that the EU recognises the UK as having an essentially equivalent level of protection in relation to personal data as that which exists within EU. Consequently, data transfers from the EU to the UK would be able to freely take place.

However, the adequacy decisions will be reviewed every 4 years – meaning that the UK will need to think twice before deviating too much from EU data protection law.

What’s Next?

Before the decisions can be finalised, the EU Commission needs to consider the views of the European Data Protection Board and seek approval from a committee of representatives of the EU Member States. The UK government sees this as a technicality and has urged the EU Commission to complete these stages as soon as possible. And whilst it is risky to count our chickens before they have hatched, we think the signs are promising. After all, the EU Commission would be setting an impossibly high threshold for adequacy if it doesn’t make final decisions in favour of the UK (bearing in mind how similar the UK and EU data protection regimes are).

We will be keeping a close eye on developments and will publish a further update as soon as final decisions are made.