The UK is eagerly awaiting an ‘adequacy decision’ by the EU Commission (EC) to confirm that UK laws provide an adequate level of protection of personal data. If this is not granted, businesses will have to implement alternative safeguards where personal data is transferred from the European Economic Area (EEA) to the UK, following Brexit.
A bridging period is currently in place for a maximum of six months, until the end of June this year, permitting the temporary free flow of data, without additional restrictions, following the end of the Brexit transition period.
A draft adequacy decision has been under review by the European Data Protection Board (EDPB) and encouragingly, the EDPB has now confirmed that it has identified “many aspects” of UK data protection laws to be “essentially equivalent” to those of the EU. This is vital for the adequacy decision to be granted and suggests that that approval is almost inevitable which is great news for UK companies doing business in the EU.
However, the EDPB stressed that this alignment must be maintained going forwards and therefore welcomed the EC’s decision to limit the duration of any UK adequacy decision. It will be interesting to see how UK data privacy laws evolve now and whether they will diverge from legislation that is currently almost identical to that of the EU. If this happens, the EC has made it clear that an adequacy decision could be withdrawn or, at the very least, not extended.
The next step is for representatives from the EU Member States to assess the UK draft adequacy decision, following which the EC may adopt the decision. We are of all course all hoping this will be done prior to the end of the bridging period to ensure business continuity.
In the unlikely event an adequacy decision is not granted in the UK’s favour, alternative safeguards will have to be adopted in order to continue to transfer data from the EEA to the UK, such as EC-approved Standard Contractual Clauses.
If you require any further advice or assistance in relation to the above, please get in touch.
Madeleine Rhodes email: mrhodes@redfernlegal.com
