On June 28, 2021 the European Commission adopts adequacy decisions for the United Kingdom – one under the General Data Protection Regulation (GDPR) and the other under the Law Enforcement Directive. Personal data can now flow freely from the European Union to the United Kingdom where it benefits from an essentially equivalent level of protection to that guaranteed under EU law. Data controllers may refer to both decisions as they take effect from the date of their adoption.
The European Commission has the power to determine whether a country outside the European Economic Area (EEA) offers an adequate level of personal data protection.Once an adequate level of protection has been decided, personal data can be transferred freely from the EEA to third parties without the need for additional guarantees, ie.these transfers are considered to be internal within the EEA.
The Commission published a press release in which the key elements of the adopted decisions are summarized. The importance of the decisions is emphasized by statements of the Vice-President for Values and Transparency, and the Commissioner for Justice. Věra Jourová, Vice-President for Values and Transparency, said: „The UK has left the EU but today its legal regime of protecting personal data is as it was. Because of this, we are adopting these adequacy decisions today. At the same time, we have listened very carefully to the concerns expressed by the Parliament, the Members States and the European Data Protection Board, in particular on the possibility of future divergence from our standards in the UK`s privacy framework. We are talking here about a fundamental right of EU citizens that we have a duty to protect. This is why we have significant safeguards and if anything changes on the UK side, we will intervene”.
Didier Reynders, Commissioner for Justice, said: „After months of careful assessments, today we can give EU citizens certainty that their personal data will be protected when it is transferred to the UK. This is an essential component of our new relationship with the UK. It is important for smooth trade and the effective fight against crime. The Commission will be closely monitoring how the UK system evolves in the future and we have reinforced our decisions to allow for this and for an intervention if needed. The EU has the highest standards when it comes to personal data protection and these must not be compromised when personal data is transferred abroad.”
The adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters.
Both adequacy decisions include strong safeguards in case of future divergence such as a ‘sunset clause`, which limits the duration of adequacy to four years.
