The European Commission (EC) has published draft adequacy decisions for personal data transfers from the EU into the UK. This will begin the process of allowing data transfer between the EU and UK to continue.
What is the current relationship between UK and EU in reguards to GDPR?
Post Brexit the UK has become a third country for the purpose of data transfers under the EU GDPR. This means data transfers from the EU to the UK could be prohibited without additional controls in place such as EU approved standard contractual clauses or binding corporate rules. An adequacy decision will allow data transfers to take place in almost wholly the same way as if the UK were a member of the EU.
How will data transfers between UK and EU continue?
The EC has determined that the UK provides an "essentially equivalent" level of protection to that guaranteed under the EU GDPR.
If adopted, the decisions will be valid for an initial term of four years, only renewable if the level of protection in the UK continues to be adequate. The decisions remain subject to review and could be revoked if the UK’s level of protection for personal data is deemed to have fallen.
The drafts now await final decision, the timescale for that is unclear. U
When will this come into effect?
ntil then organisations may receive personal data from the EU under the temporary bridging mechanism agreed between the EU and UK which expires at the end of June 2021.
Although it can’t be assumed that an adequacy decision will be made, this is a positive step toward ensuring personal data flows may continue.
The European Commission’s press release can be found here.
Find out more
If you would like any help or support then visit our dedicated Intellectual Property pages or contact our expert team.
