EU: Commission adopts positive UK adequacy decisions
The European Commission announced, on 28 June 2021, that it had adopted two adequacy decisions for the United Kingdom, one under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and one under the Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680). In particular, the Commission highlighted that, among other decisive factors, the UK's data protection system continues to be based on the same rules that were applicable when the UK was a Member State of the EU, and the UK has fully incorporated the principles, rights, and obligations of the GDPR and the Directive into its post-Brexit legal system.
In addition, the Commission outlined that personal data can now flow freely from the EU to the UK where it benefits from an essentially equivalent level of protection to that guaranteed under EU law, whilst also noting that the adequacy decisions can facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information. Furthermore, the Commission noted that both adequacy decisions include strong safeguards in case of future divergence, including a sunset clause, which limits the duration of adequacy to four years. Further to this point, the Commission emphasised that it continues to monitor the legal situation in the UK and could intervene at any point if the UK deviates from the level of protection currently in place.
Notably, the Commission outlined that transfers for the purposes of UK immigration control are excluded from the scope of the GDPR adequacy decision in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area. Further to this, the Commission outlined that it will reassess the need for this exclusion once the situation has been remedied under UK law.