Following nine months of assessment of the UK’s data protection laws (including the rules on access to data by public authorities), the European Commission has today published its draft decision on the adequate protection of personal data by the United Kingdom. The draft decision can be found here.
The draft decision is welcome news to the UK government, which has stressed that adequacy will provide certainty for businesses and enable continued cooperation between the UK and EU.
The European Commission’s statement highlights that EU law has shaped the UK’s data protection regime for decades; and that whilst the UK has left the EU, it remains a member of the European “privacy family”, particularly because the UK has committed to remain party to the European Convention on Human Rights and Convention 108.
Notwithstanding this however, the European Commission remains mindful of UK privacy law potentially diverging from EU law and has made it clear that an adequacy decision, once adopted, would remain valid for a period of four years. After this, the UK privacy regime will be reviewed to determine whether or not to renew the adequacy decision.
The draft decision will now be shared with the European Data Protection Board for a non-binding opinion. After taking this into account, the European Commission will present the draft decision to EU Member States for formal approval, as part of the comitology procedure. Following this, the European Commission may adopt the draft decision.
Our take
With the interim EU to UK free personal data flow regime under the EU-UK Trade and Cooperation Agreement due to expire at the end of 30 June 2021, the pressure will be on to obtain an early EDPB opinion and EU Member State decision; however more likely, as with all things “Brexit”, it will go to the 11th hour, so those stand by EU to UK SCCs cannot quite be mothballed yet. We will be analysing the draft decision and EDPB opinion once it is published.