The EU Commission looks set to adopt two adequacy decisions in favour of the UK, which will allow businesses to continue to freely transfer personal data from the EU/EEA to the UK. On 19 February 2021, the EU Commission published two draft adequacy decisions permitting transfers of personal data to the UK under the GDPR, and under the Law Enforcement Directive (LED).
Once adopted, the decisions will replace the interim solution agreed under the EU-UK Trade and Cooperation Agreement (previously discussed here). That agreement allows businesses to transfer personal data from the EU/EEA to the UK, without putting in place additional safeguards, until 30 June 2021 or an adequacy decision comes into effect, whichever is sooner.
Next steps
The EU Commission will next obtain an opinion from the EDPB. It will then need to obtain the green light from a committee of representatives of the EU Member States. Once this procedure is completed, the EU Commission may adopt the UK adequacy decisions. In line with Article 45(3) of the GDPR and Article 36 of the LED, the UK adequacy decisions will be reviewed every four years to ensure the UK continues to offer an adequate level of protection.
The UK Government’s Press Release welcoming the draft adequacy decisions is available here.