The European Commission (EC) has published draft adequacy decisions for personal data transfers from the EU into the UK. This will begin the process of allowing data transfer between the EU and UK to continue.
Post Brexit the UK has become a third country for the purpose of data transfers under the EU GDPR. This means data transfers from the EU to the UK could be prohibited without additional controls in place such as EU approved standard contractual clauses or binding corporate rules. An adequacy decision will allow data transfers to take place in almost wholly the same way as if the UK were a member of the EU.
The EC has determined that the UK provides an "essentially equivalent" level of protection to that guaranteed under the EU GDPR.
If adopted, the decisions will be valid for an initial term of four years, only renewable if the level of protection in the UK continues to be adequate. The decisions remain subject to review and could be revoked if the UK’s level of protection for personal data is deemed to have fallen.
The drafts now await final decision, the timescale for that is unclear. Until then organisations may receive personal data from the EU under the temporary bridging mechanism agreed between the EU and UK which expires at the end of June 2021.
Although it can’t be assumed that an adequacy decision will be made, this is a positive step toward ensuring personal data flows may continue.
The European Commission’s press release can be found here Data protection: draft UK adequacy decision (europa.eu)
For further advice and guidance on GDPR please visit our hub page, or contact our team of expert lawyers.