The European Data Protection Board ('EDPB') announced, on 14 April 2021, that it had adopted two opinions on the draft UK adequacy decisions, guidelines on the application of Article 65(1)(a) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), guidelines on the targeting of social media users, and a statement on international agreements including transfers.

In particular, the EDPB adopted Opinion 14/2021, which assesses both general data protection aspects and government access to personal data transferred from the EEA for the purposes of law enforcement and national security included in the draft adequacy decision, and Opinion 15/2021 which is based on the Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680) ('the Law Enforcement Directive') and analyses the draft adequacy decision in the light of Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive, as well as the relevant case law reflected in Recommendations 02/2020 on the European Essential Guarantees for surveillance measures.

Notably, the EDPB stated that the UK and EU data protection frameworks are aligned in relation to certain key provisions, including: grounds for lawful and fair processing for legitimate purposes, purpose limitation, data quality and proportionality, data retention, security and confidentiality, transparency, special categories of data, as well as on automated decision making and profiling.

However, the EDPB outlined that the following should be further assessed and/or closely monitored by European Commission:

• the immigration exemption and its consequences on restrictions on data subject rights; and
• the application of restrictions to onward transfers of EEA personal data transferred to the UK, on the basis of, for instance, future adequacy decisions adopted by the UK, international agreements concluded between the UK and third countries, or derogations.

While the EDPB welcomed the establishment of the Investigatory Powers Tribunal and the introduction of Judicial Commissioners, it also identified a number of points that require further clarifications and/or monitoring, including bulk interceptions, the independent assessment and oversight of the use of automated processing tools, and the safeguards provided under UK law in relation to overseas disclosures.

In addition, the EDPB adopted guidelines on the application of Article 65(1)(a) GDPR which aim to outline the procedure and clarify the competence of the EDPB and the final version of the guidelines on the targeting of social media users which seek to clarify the roles and responsibilities of social media providers and targeted individuals.

Finally, the EDPB stated that EU Member States should look to assess and, where necessary, review their international agreements that involve international transfers of personal data which were concluded before 24 May 2016, for those relevant to the GDPR, and 6 May 2016, for those relevant to the Law Enforcement Directive, in order to align them, where necessary, with EU data protection law.

You can read the press release here.