European Commission publishes draft adequacy decision permitting data flows from EU to UK

The European Commission has published a draft decision on the adequacy of the UK’s law and practice on personal data protection. If adopted this will allow for the continued free flow of personal data from the EU to the UK. To be clear this only affects the flow of data from the EU to the UK. The flow of data from the UK to the EU is regulated by UK legislation and the UK has already determined that the EU provides an adequate level of protection.

Current position

The EU-UK Trade and Cooperation Agreement put in place a time-limited ‘bridging mechanism’ for personal data transfers from the EU to the UK. This currently allows personal data to continue to flow as it did before the end of the Brexit transition period for up to six months, while the EU completes the adequacy process. The ‘bridging mechanism’ remains in place until 30 June 2021 or until the adequacy decision comes into effect (whichever is sooner).

What’s next

The draft decision will now be shared with the European Data Protection Board. If the green light is given by the EDPB the draft decision will be presented to EU member states for formal approval. In a recent press release by the UK Government, it has urged the EU to swiftly complete this technical process for adopting and formalising the adequacy decision as early as possible.

Why is this important

Following the end of the Brexit transition period the UK became a third country for the purposes of EU data protection. This means without the ‘bridging mechanism’ or an adequacy decision, businesses would only be able to be transfer personal data from the EU to the UK in limited circumstances such as: potentially putting in place Standard Contractual Clauses, conducting transfer impact assessments or other appropriate safeguards. If the UK is found to be adequate, the transfer of personal data from the EU to the UK can take place without being subject to any further conditions. The UK Government has said this will provide certainty for businesses, enable continued cooperation between the UK and the EU, and will ensure law enforcement authorities can keep UK citizens safe.

Given that UK law provides an equivalent level of protection under the UK GDPR and Data Protection Act 2018, it is hoped that the adequacy decision will be granted.

This is a significant first step and a very welcome announcement. It will mean that our clients in Ireland and across Europe should have one less issue to worry about when operating in the UK. We will provide further updates in due course.

A copy of the draft adequacy decision is available here.