EU: EDPB releases opinions on draft UK adequacy decisions
The European Data Protection Board ('EDPB') released, on 15 April 2021, its Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom ('Opinion 14/2021') and Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom ('Opinion 15/2021').
In relation to Opinion 14/2021, the EDPB highlighted that many aspects of the UK framework are essentially equivalent, however outlined a number of areas that should be further assessed and/or monitored by the Commission, including:
- possible future divergences creating risks for the maintenance of the level of protection provided to personal data transferred from the EU;
- the 'immigration exemption,' which the EDPB calls on the Commission to provide further information on, particularly in relation to its necessity and proportionality;
- the possibility of amending and/or suspending the adequacy decision if the adequacy decision is not maintained in order to introduce specific safeguards for data transferred from the EEA;
- the interplay between the UK data protection framework and its international agreements;
- the scenarios for which a lawful interception without approval by the Investigatory Powers Commissioner or the Judicial Commissioners are possible;
- bulk interceptions, in particular the selection and application of the selectors; and
- the overall safeguards provided under UK law when it comes to overseas disclosure, specifically in light of the application of national security exemptions.
Regarding Opinion 15/2021, the EDPB noted that there is a strong alignment between the Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680) and the UK legal framework on certain core provisions. In addition, the EDPB stated that Chapter 5 of Part 3 of the Data Protection Act 2018 provides for a level of protection that is essentially equivalent to the one guaranteed under EU law, in relation to the transfer of personal data from a UK law enforcement authority to a third country.
Nonetheless, the EDPB recommended that the Commission should provide further information regarding the existence of a mechanism to inform the relevant Member States' competent authorities of further processing or disclosure by the UK authorities to which they transferred the personal data, and identify its effectiveness under the UK legal order.
Furthermore, the EDPB recommended that the Commission should continuously monitor the conclusion of future agreements with third countries for the purpose of law enforcement cooperation with the view to determining whether the provisions may affect the application of UK data protection law and provide for additional limitations or exemptions regarding the further use and disclosure overseas of information collected for law enforcement purposes.