EU releases draft UK data transfer clearance

The EU Commission has published draft decisions which are likely to lead to the full approval  for transfers of personal data to the United Kingdom.

Over the past months, the Commission has been assessing the UK's law and practice on personal data protection, including the rules on access to data by public authorities, with a view to approving the continued transfer of personal data to and from EU member states after the conclusion of the Brexit process. It has concluded that the UK ensures an essentially equivalent level of protection to the one guaranteed under EU law.

The two draft decisions, one under the General Data Protection Regulation and the other for the Law Enforcement Directive, will now be submitted for an opinion from the European Data Protection Board (EDPB) and approval by a committee composed of representatives of the EU Member States. Once this procedure will have been completed, the Commission could proceed to adopt the two adequacy decisions.

In order to ensure that the adequacy findings are future proof now that the UK is no longer bound by EU privacy rules, the draft decisions, once adopted, would be valid for a first period of four years. After four years, it would be possible to renew the adequacy finding if the level of protection in the UK continues to be adequate.

Pending adoption, data flows between the European Economic Area and the UK are safeguarded by a conditional interim regime that was agreed in the EU-UK Trade and Cooperation Agreement. This interim period expires on 30 June 2021.

Publishing its decisions, the Commission noted that the UK is, and has committed to remain, party to the European Convention on Human Rights and to “Convention 108” of the Council of Europe, the only binding multilateral instrument on data protection. Continued adherence to such international conventions, it observed, "is of particular importance for the stability and durability of the proposed adequacy findings".

Věra Jourová, Vice President for Values and Transparency, commented: "Ensuring free and safe flow of personal data is crucial for businesses and citizens on both sides of the Channel. The UK has left the EU, but not the European privacy family. At the same time, we should ensure that our decision will stand the test of time. This is why we included clear and strict mechanisms in terms of both monitoring and review, suspension or withdrawal of such decisions, to address any problematic development of the UK system after the adequacy would be granted."EU