The European Commission (EC) has published the draft renewal of the EU-UK adequacy decision, meaning that EU businesses will be able to continue to transfer personal data (for example of employees and customers) to the UK without the need for further cumbersome safeguards. A similar decision is in place for UK-EU transfers.
There was a question mark over whether this renewal would be granted in light of the advent of the UK’s Data (Use and Access) Act, which came into force at the end of June bringing with it various changes to UK data protection laws, however the EC seems satisfied that privacy laws in the UK still provide an adequate level of protection to the data subjects concerned.
The caveats to this decision are that UK data protection laws must be monitored to ensure the equivalent level of protection is maintained, any further changes to UK data protection laws will trigger a reassessment and data subjects must have a clear means of challenging the misuse of their personal data.
Of course, if the UK’s data protection landscape evolves further in coming years, the EC have the right to revoke the decision at any time. It will be due for review again, in any event, in 2029.
But for now, good news for businesses operating in the UK and EU.
If you would like advice on international personal data transfers or data protection compliance generally, please get in touch
Madeleine Rhodes Mrhodes@redfernlegal.com
