Context
The European Commission has published its draft UK adequacy decisions in relation to the processing of personal data. If adopted, these adequacy decisions will allow for the continued free flow of personal data from the EU into the UK, which will provide welcome relief for many UK businesses dealing with data from the EU. This will provide certainty for businesses, enable continued co-operation between the UK and the EU, and will ensure law enforcement authorities can keep citizens safe.
The government welcomes the European Commission’s draft data adequacy decisions, which recognise the UK’s high data protection standards and set out that the UK should be found ‘adequate’. The UK takes the protection of personal data very seriously, and has a data protection system currently the same as the European Union’s; it is logical that the Commission should find the UK ‘adequate’.
Positive data adequacy decisions under both the EU General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) would allow for personal data to continue to flow freely from the European Union (EU) and wider European Economic Area (EEA) to the UK.
Technical confirmation of the draft adequacy decisions will help make sure UK businesses and organisations can continue to receive personal data from the EU and EEA without additional compliance costs. This ensures they will avoid potential knock-on effects for consumers.
The draft decisions published today by the Commission will now be shared with the European Data Protection Board for a ‘non-binding opinion’, before being presented to EU member states for formal approval. The UK government has urged the EU to swiftly complete this technical process for adopting and formalising these adequacy decisions as early as possible. During this process, UK businesses and public authorities will continue to be able to receive data from the EU under the adequacy bridge agreed in the 2020 trade and co-operation agreement.
- The ‘bridging mechanism’ will remain in place until June 30 or until the adequacy decisions come into effect, whichever is sooner.
- Read the European Commission’s press statement here.
- Read the GDPR decision here.
Next actions
None – for information.