Businesses that transfer data to and from Europe will be delighted to hear that the European Commission has given a green light for continued data flows. On 28 June 2021, the European Commission published its final General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED) adequacy decisions in favour of the UK. This means that businesses and organisations in the UK who transfer data to and from Europe (whether that be to a group company, a payroll provider or an IT services provider) can do so, freely, without having to put in place an alternative safeguard mechanism – such as using Standard Contractual Clauses or Binding Corporate Rules.
With just two days to go until the official deadline of 30 June, these adequacy decisions mean that personal data can now flow freely from the European Union to the United Kingdom, as the European Commission has agreed that UK data protection law offers an ‘essentially equivalent’ level of protection to that guaranteed under EU law. The adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters.
However, there should be a degree of caution as both adequacy decisions include a "sunset clause", which limits the duration of the decisions. Therefore, the adequacy decisions will automatically expire four years after they enter into force (i.e. they will expire on 27 June 2025). After this period, the adequacy findings will require to be renewed, but only if the UK continues to ensure an adequate level of data protection. The European Commission has indicated that it will closely monitor the legal position in the UK during this four year period and may suspend, repeal or amend the adequacy decisions, for example if UK law deviates from the level of data protection currently in place. This is being seen as a warning shot to the UK Government to carefully consider any reforms that may be being planned for UK data protection law and practice in a post-Brexit UK.
These decisions will bring a great deal of relief to businesses, many of whom had effectively put their data transfer decisions on hold pending the outcome of European Commission’s adequacy decision. It means that businesses can now proceed with a degree of certainty and avoid (at least for the time being) another round of re-papering of data transfer contracts.
Please get in touch if you require advice on your international data transfers.
Written by
Related News, Insights & Events
A guide to the ECCTA ID verification process
A step-by-step guide to verify your identity online to comply with the identity verification (IDV) regime introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA).
Cyber Crime in the Trust Economy: Navigating an evolving threat landscape
Read our latest Trust Economy paper here.
Risk in commercial shipping – The Supreme Court clarifies the scope of Hague Visby Rules for claims for misdelivery of cargo
A Supreme Court decision has shed light on the scope of protection for carriers under a key international convention, highlighting the need for thorough risk assessment in the contracting process.
