Data protection: EU transfers flow for a little longer

Further to my article in the December 2020 Journal where I set out the difficulties that may arise if the UK left the EU without an adequacy decision, the EU Trade and Cooperation Agreement which was finalised on 24 December 2020 provided us with a bridging mechanism which meant that data transfers from the EU/EEA to the UK could continue without additional safeguards until either (a) an adequacy decision was granted, or (b) for up to six months.

At the same the EU GDPR was retained in UK law and became what is known as the UK GDPR. This has not changed the law in any substantive way, but has changed the way we must refer to it in contracts, agreements and privacy notices etc. 

Draft Adequacy Decision

The latest update is that on 19 February 2021 the EU announced that it had taken the first steps towards the approval of an adequacy decision for the UK in relation to the transfer of personal data under the GDPR, and in relation to the transfer of personal data for law enforcement purposes under the Law Enforcement Directive.

The EU Commission has drafted its decisions, which can be found here, and they will now be considered by the European Data Protection Board and a committee representing the EU member states as part of the comitology procedure. This will hopefully lead to the decisions being adopted, allowing personal data to flow between the EEA countries and the UK without additional safeguards.

It was hoped that as the UK had implemented the GDPR, the EU Commission’s assessment would be a straightforward one, finding that the UK had adequate safeguards in place to provide EU citizens with adequate rights and protections under data protection law. But there were various concerns raised, including the UK state surveillance arrangements which had been criticised by the European Court of Human Rights in October 2020 (see Privacy International v Secretary of State for Foreign and Commonwealth Affairs C-623-17). Other concerns had been raised about the ability to change data protection law built into the Data Protection Act 2018 and the potential for data subject rights to be weakened.

This is good news for all organisations who rely on data flowing between the UK and EU/EEA: the EU Commission found an essentially equivalent level of protection was available in the UK, paving the way for the adequacy decision. It is hoped that this decision will provide some certainty, in the area of data transfers at least.

Review

The adequacy decisions will be reviewed after four years to ensure that the UK continues to provide essentially equivalent protection. Commitment to the European Convention on Human Rights and the EU Charter is noted by the EU Commission as important to its adequacy decision. Any deviation from that commitment, and any changes that the UK makes to data protection law which weakens protections for data subjects over the next four years, will be taken into account at this review.

There is also still the possibility that the decision will be challenged, as Max Schrems has now done successfully twice in relation to the two partial adequacy decisions relating to transfers to the US. Both Safe Harbour and the Privacy Shield have been struck down by the EU Court of Justice, so the UK must be wary of a challenge from his organisation or similar. It is therefore also to be hoped that this “certainty” is not short lived.