Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

EU: Commission adopts positive UK adequacy decisions

The European Commission announced, on 28 June 2021, that it had adopted two adequacy decisions for the United Kingdom, one under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and one under the Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680). In particular, the Commission highlighted that, among other decisive factors, the UK's data protection system continues to be based on the same rules that were applicable when the UK was a Member State of the EU, and the UK has fully incorporated the principles, rights, and obligations of the GDPR and the Directive into its post-Brexit legal system.

In addition, the Commission outlined that personal data can now flow freely from the EU to the UK where it benefits from an essentially equivalent level of protection to that guaranteed under EU law, whilst also noting that the adequacy decisions can facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information. Furthermore, the Commission noted that both adequacy decisions include strong safeguards in case of future divergence, including a sunset clause, which limits the duration of adequacy to four years. Further to this point, the Commission emphasised that it continues to monitor the legal situation in the UK and could intervene at any point if the UK deviates from the level of protection currently in place.

Notably, the Commission outlined that transfers for the purposes of UK immigration control are excluded from the scope of the GDPR adequacy decision in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area. Further to this, the Commission outlined that it will reassess the need for this exclusion once the situation has been remedied under UK law.

You can read the press release here, the GDPR adequacy decision here, and the Directive adequacy decision here