Last Friday 21 May 2021, MEPs passed a resolution asking the EU Commission to modify its draft UK adequacy decisions, to bring them into line with recent EU court rulings and to address concerns raised by the European Data Protection Board (EDPB) in its recent opinions. The EDPB stated that UK law and practice relating to bulk data collection, onward transfers and its international agreements in the field of intelligence sharing, need to be further assessed by the EU Commission.
The resolution calls on national data protection authorities to suspend transfers of personal data to the UK, where it might be subject to indiscriminate access by UK intelligence authorities, if the Commission adopts the draft UK adequacy decisions before addressing the deficiencies identified in the EDPB opinions and in the MEP’s resolution.
Next steps
The EU Commission is not bound by the Parliament’s resolution, but will be under political pressure to take the MEP’s concerns on board. The EU Commission now has just over a month to finalize the UK data adequacy decisions before the interim solution agreed under the EU-UK Trade and Cooperation Agreement permitting the free flow of data from the EU to the UK expires on 30 June 2021.
Addressing the plenary before the vote, Commissioner for Justice Didier Reynders stressed that the UK’s current data protection legislation is very similar to that of the EU. However, future divergence is possible, and this is why the draft adequacy decision’s four-year sunset clause is necessary.