Data transfer to GB secured for the next 4 years

The EU Commission today adopted two adequacy decisions on the UK - one under the General Data Protection Regulation (GDPR) and one under the Data Protection in Law Enforcement Directive. Both decisions came into force on 28.06.2021. Personal data can now flow freely from the European Union to the United Kingdom, where it will be subject to a level of protection equivalent in substance to that guaranteed under EU law.

The two adequacy decisions also facilitate the proper implementation of the EU-UK Trade and Cooperation Agreement, which provides for the exchange of personal data (for example, in the context of judicial cooperation). Data transfers for immigration control practiced by the UK are excluded from the material scope of the adequacy decision adopted under the GDPR. Both adequacy decisions contain strong safeguards in case of possible future derogations, including a sunset clause limiting their respective duration to four years.

Most important elements of the adequacy decisions:

The UK data protection system continues to be based on the same rules that applied when the UK was still a member state of the EU. The UK has fully incorporated the principles, rights and obligations of the GDPR and the Data Protection in Law Enforcement Directive into its current legal system in place since Brexit.
In relation to access to personal data by public authorities in the UK (particularly for national security reasons), the UK system provides strong safeguards. In particular, data collections by intelligence services are subject to prior authorisation by an independent judicial body. All measures must be necessary and proportionate to the objective pursued. Anyone who feels they have been subjected to unlawful surveillance measures can bring a claim before the Investigatory Powers Tribunal. The UK is also subject to the jurisdiction of the European Court of Human Rights, the European Convention on Human Rights and the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the only binding international convention in the field of data protection. These obligations under international law are an essential part of the legal framework assessed in the two adequacy decisions.
For the first time, the adequacy resolutions contain a sunset clause that strictly limits their period of validity: Both decisions expire four years after their entry into force. After that, they could be renewed if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to keep an eye on the legal situation in the UK and will be able to intervene at any time if the UK deviates from the level of data protection currently in place. Should the Commission decide to renew the adequacy decisions, the adoption process would start again.
Data transfers for immigration control practised by the UK are excluded from the material scope of the adequacy decision adopted under the GDPR in order to take into account a recent decision of the Court of Appeal of England and Wales on the validity and interpretation of certain limitations to data protection rights in this area. Once this situation is clarified under UK law, the Commission will reconsider the need for this exclusion.

Background:

The Commission published two draft adequacy decisions on 19 February and launched the procedure for their adoption. Over the past months, the Commission has carried out a thorough assessment of the UK legislation and practices in the area of personal data protection, including the provisions on access to data by public authorities in the UK. The Commission has been in close contact with the European Data Protection Board, which delivered its relevant opinion on 13 April, with the European Parliament and with Member States. Following this thorough assessment, the European Commission sought the consent of the Member States' representatives to the two adequacy decisions under the so-called comitology procedure. Today's adoption of the decisions, following the agreement of the Member States' representatives, was the final step of this procedure. The two adequacy decisions enter into force today.

The EU-UK Trade and Cooperation Agreement contains a commitment by the EU and the UK to maintain high standards of data protection. The agreement also provides that any data transfers to be carried out in the course of its implementation must be in accordance with the relevant data protection legislation of the transferring party (in the case of the EU, these are the GDPR and the Data Protection in Law Enforcement Directive). The adoption of the two unilateral and stand-alone adequacy decisions is an important measure to ensure the proper application and functioning of the agreement. The EU-UK Trade and Cooperation Agreement also provides for a conditional transitional arrangement under which data can be transferred freely from the EU to the UK. The transition period ends on 30 June 2021.