UK Adequacy Decision - Data can continue to flow from the EU
Businesses that transfer data to and from Europe will be delighted to hear that the European Commission has given a green light for continued data flows. On 28 June 2021, the European Commission published its final General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED) adequacy decisions in favour of the UK. This means that businesses and organisations in the UK who transfer data to and from Europe (whether that be to a group company, a payroll provider or an IT services provider) can do so, freely, without having to put in place an alternative safeguard mechanism – such as using Standard Contractual Clauses or Binding Corporate Rules.
With just two days to go until the official deadline of 30 June, these adequacy decisions mean that personal data can now flow freely from the European Union to the United Kingdom, as the European Commission has agreed that UK data protection law offers an ‘essentially equivalent’ level of protection to that guaranteed under EU law. The adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters.
However, there should be a degree of caution as both adequacy decisions include a "sunset clause", which limits the duration of the decisions. Therefore, the adequacy decisions will automatically expire four years after they enter into force (i.e. they will expire on 27 June 2025). After this period, the adequacy findings will require to be renewed, but only if the UK continues to ensure an adequate level of data protection. The European Commission has indicated that it will closely monitor the legal position in the UK during this four year period and may suspend, repeal or amend the adequacy decisions, for example if UK law deviates from the level of data protection currently in place. This is being seen as a warning shot to the UK Government to carefully consider any reforms that may be being planned for UK data protection law and practice in a post-Brexit UK.
These decisions will bring a great deal of relief to businesses, many of whom had effectively put their data transfer decisions on hold pending the outcome of European Commission’s adequacy decision. It means that businesses can now proceed with a degree of certainty and avoid (at least for the time being) another round of re-papering of data transfer contracts.
Please get in touch if you require advice on your international data transfers.
4th June 2021
The European Commission has published the final version of the new Standard Contractual Clauses.
23rd March 2021
The key feature of the new legislation is that it seeks to introduce a “duty of care” for companies.
22nd February 2021
The European Commission has published two draft “data adequacy” decisions in favour of the UK.