28 June 2021
The long awaited decision of the European Commission, to recognise the UK as 'adequate' for persona data transfers arrived just before the temporary arrangement was set to expire on 30th June.
This follows draft adequacy decisions made on 19th February. Since then, the Commission has assessed UK laws and practices on personal data protection, including access to personal data by UK public authorities and published a 93-page GDPR decision that even references the Magna Carta and the Bill of Rights.
It states that ‘As the UK GDPR is based on EU legislation, the data protection rules in the United Kingdom in many aspects closely mirror the corresponding rules applicable within the European Union,’ and concludes that ‘the Commission considers that the UK GDPR and the DPA 2018 ensure a level of protection for personal data transferred from the European Union that is essentially equivalent to the one guaranteed by Regulation (EU) 2016/679.’
This will be a relief to UK business as personal data can continue to low freely to the UK from EU countries for at least the next four years, when a 'sunset clause' kicks in and terminates the decision unless it has been renewed by then.
We wait to see however whether this decision is challenged via national regulatory bodies and thence to the European Court of Justice (ECJ) on the lines of the Schrems I / II cases that destroyed the US 'Safe Harbor' and 'EU-US Privacy Shield' schemes.
If this decision is ultimately proved unlawful, the new Standard Clauses and extra security assessments may have to be invoked instead.
Copyright © Exigia Ltd., All rights reserved