On 31 January 2020, the UK officially left the European Union and became a third country with regard to transfers of personal data. Transferring personal data outside the EU (and more broadly, the European Economic Area) means taking the risk that the data are subject to a more lenient legislation, and may take place only if the conditions laid down in Articles 45 to 49 of the GDPR are complied with. In accordance with Article 45 GDPR, data may be transferred to a third country provided that this country has been recognised by the European Commission as offering an adequate level of protection (a so-called “adequacy decision”). Personal data can then be transferred from the EU to this third country without additional safeguards since the transfer will be assimilated to a transfer inside the EU.
In order to accommodate entities still transferring personal data to the UK, the Trade and Cooperation Agreement concluded between the 27 EU Member States and the UK included an interim regime according to which a transfer of personal data to the UK is not yet considered as a transfer of personal data to a third country. This interim regime is in force until 30 June 2021. The agreement sets out some conditions that must be respected by the UK:
• The data protection legislation incorporated in UK domestic law as amended by the GDPR must continue to apply;
• The UK cannot change this legislation without the EU’s approval.
The agreement also provides that it will terminate as soon as the European Commission has adopted an adequacy decision in favour of the UK.
Earlier this year, after careful examination, the Commission has concluded that the UK’s legislation ensures an essentially equivalent level of protection to the one guaranteed under the GDPR and under the Law Enforcement directive (Directive 2016/680).
Therefore, on 19 February 2021, the Commission has started the process to adopt two adequacy decisions regarding the transfer of personal data to the UK, and published (i) a draft implementing decision under the GDPR and (ii) a draft implementing decision under the Law Enforcement directive.
On 13 April 2021, the European Data Protection Board (“EDPB”) adopted its opinion regarding the Commission’s draft implementing decision under the GDPR (Opinion 14/2021). The opinion is mainly positive towards the adoption of the UK’s adequacy decision. However, the EDPB noted “that several items should be further assessed and/or closely monitored by the European Commission in its decision based on the GDPR”.
On 17 June 2021, the Commission also got the approval of a committee composed of representatives from the EU Member States, which considered that UK’s data protection standards were high enough to allow data to flow from Europe to the UK and voted unanimously in favour of the adequacy decisions.
This was the last step of the procedure. The Commission can now proceed to adopt the adequacy decisions before the end of June. As such, personal data can continue to flow freely from Europe to the UK after the end of the six-month interim period.
The UK’s data protection law was shaped by EU law, but it is essential that the adequacy findings are future-proof since the UK will no longer be bound by EU data protection law. In this regard, the UK’s Digital Secretary Oliver Dowden’s comments earlier this year - saying the UK would not seek to undercut EU data protection standards but would look for “opportunities” to foster growth in the field - raised concerns in Brussels. It is expected that the Commission will be keeping a close eye on the UK, and only time will tell if personal data can continue to flow freely from the EU to the UK.
Please contact Karel Janssens for further information regarding the above and/or for general legal advice relating to privacy and data protection.