European Commission adopts UK Adequacy Decision

As from 28 June 2021, personal data can finally flow freely from the European Union to the United Kingdom, since it benefits from an essentially equivalent level of protection to that guaranteed under EU law, according to the new UK adequacy decision.

The European Commission (EC) adopted two decisions: one regarding the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive. Such adoption represents the duly implementation of the EU-UK Trade and Cooperation Agreement, which stipulates the exchange of personal data between the EU and the UK (e.g. for cooperation on judicial matters).

Unprecedented sunset clause

For the first time, the EC’s adequacy decision includes safeguards for any future divergence such as a called “sunset clause”, which limits the duration of adequacy to four years. It should be highlighted that during these four years, the Commission will continue to monitor the legal situation in the UK and may intervene at any time whether UK deviates from the EU data protection law.

Immigration exception

Furthermore, one type of transfer from EU to UK has been excluded from the scope of the adequacy decision, namely: transfers for the purposes of UK immigration control. This approach echoes a recent judgment of the England and Wales Court of Appeal on certain restrictions of data protection rights in this regard.

UK Data Protection Law

Having said that, the adoption by the EC represents that, at this time, the UK's data protection legal framework continues to be grounded on the same rules that were applicable when the UK was a Member State of the EU. For example, the UK has fully incorporated the principles, rights, and obligations of the GDPR.

You may wish to read on the following link the full text of: EC adequacy decision on the adequate protection of personal data by the United Kingdom (UK)

Article by IDPC, 28th June 2021