UK data protection ‘adequacy’ gets EU governments’ sign-off
It has been reported that European Union member states have agreed that British standards for the protection of personal data are sufficiently high that such information can continue to flow between the EU and the UK. The decision paves the way for personal data to continue to be transferred freely from the EU to the UK and will be welcomed by multinational companies. EU Member States were given a short timescale request by the EU Commission to review and approve the draft adequacy decisions that were in place so they could be formalised.
After Brexit, when the UK’s ‘adequacy’ was previously guaranteed by the fact that the UK was either in the EU or in the Transition Period and was therefore subject to the EU GDPR, transitional data sharing arrangements were agreed alongside the EU-UK Trade and Cooperation Agreement reached in late 2020. This allowed personal data to continue to flow freely from EU member states to the UK in the short-term, but there had been uncertainty over the longer-term position. In February this year the European Commission issued draft ‘adequacy decisions’ with a view to facilitating the continued free flow of personal data from the EU to the UK. The Commission’s draft adequacy decisions for the UK must be formally approved by representatives of EU member state governments, and are also subject to a non-binding opinion of the European Data Protection Board (EDPB). The endorsement of EU member states paves the way for the Commission to finalise the UK’s adequacy decisions before the end of June, when the current transitional arrangements in respect of EU-UK personal data flows expire. For data transfers from the UK to the EU, the UK government had already confirmed these are authorised to continue until at least 2024.