The European privacy family – the long-awaited EU–UK data adequacy decisions

Posted on: |

On 28 June 2021, after months of anticipation, the European Commission announced that the adequacy decisions for the UK, one under the General Data Protection Regulation and the other for the Law Enforcement Directive, have been approved. This means that, while the UK has left the EU, it has remained a member of the EU privacy family.

The adoption of the adequacy decisions means that businesses and individuals (whether data controllers or processors) in the EU can freely transfer personal data from the EU to the UK, subject to certain specific exceptions.

What about transfers of personal data from the UK to the EU?

Following Brexit, the UK has decided that the EU has adequate data protection laws in place, accordingly, flow of personal data from the UK to the EU has been permitted under the UK legislative framework from 1 January 2021, meanwhile the EU has set 1 July 2021 to be the deadline for the adoption of the adequacy decisions.

Are the adequacy decisions indefinite?

It is noteworthy that the adequacy decisions include strong safeguards in case of future divergence of the UK data protection framework from that of the EU. The adequacy decisions are presently guaranteed only for an initial period of four years after entry into force, after which they will expire automatically. Nevertheless, provided that the Commission continues to be satisfied with the level of protection of personal data, the adequacy decisions will be extended for a further period.

During the period while the adequacy decisions remain in force, the Commission undertakes to monitor the UK’s approach to safeguarding personal data and, should it be dissatisfied, it may withdraw its adequacy decisions at any point. Such rigorous approach requires close cooperation between the EU and the UK. The only question that remains – is whether the decisions can stand the test of time.

Key takeaways:

  • free flow of personal data from the EU to the UK as well as from the UK to the EU;
  • no requirement to enter into Standard Contractual Clauses for UK-EU data transfers;
  • transfers for the purposes of UK immigration control are excluded from the scope of the adequacy decision;
  • adequacy decisions can be withdrawn at any point, if the UK data protection regime deviate so to no longer be deemed adequate; and
  • EU data subjects can be certain that the UK upholds data subjects’ fundamental right to data protection.

Avery Law is the business and trading name for a legal practice carried on by Avery Law LLP. Avery Law LLP is a limited liability partnership, registered in England and Wales, with registered number OC374426, with its registered office at 25 Wilton Road, London, SW1V 1LW.

Avery Law LLP is authorised and regulated by the Solicitors Regulation Authority of England and Wales (SRA ID: 568560).

Avery Law LLP is registered with the Information Commissioner’s Office (ICO) with registration number ZA135485.

Subscribe to our mailing list in order to opt-in to receive our publications, deal insights or event invitations.

© Avery Law LLP 2022 - All rights reserved.