EU: European Commission publishes draft UK adequacy decision
The European Commission launched, on 19 February 2021, the process towards the adoption of two adequacy decisions for the transfers of personal data to the UK, one under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and the other under the Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680) ('the Law Enforcement Directive'). In particular, the Commission highlighted that it has assessed the UK's law and practice on personal data protection, including the rules on access to data by public authorities, and concluded that the UK ensures an essentially equivalent level of protection to the one guaranteed under both the GDPR and the Law Enforcement Directive.
Furthermore, the Commission outlined that although EU law has shaped the UK's data protection regime, it is essential that the adequacy findings are future proof now that the UK will no longer be bound by EU privacy rules. In addition, the Commission noted that, if adopted, the draft decisions would be valid for a period of four years, after which the adequacy finding could be renewed if the level of protection in the UK continues to be adequate.
The European Data Protection Board must now provide its opinion on the findings, after which the Commission will request approval from Member States' representatives in the comitology procedure before adopting the final adequacy decisions for the UK.
Data flows between the European Economic Area and the UK will remain safeguarded under the conditional interim regime that was agreed in the EU-UK Trade and Cooperation Agreement until 30 June 2021.