Data transfers: draft adequacy decision published

On 19 February 2021, the European Commission published its draft adequacy decision for data transfers from the EEA to the UK. This is the first step in the process that will allow for the continued free flow of personal data from the EEA into the UK (discussed here).

Under the current arrangements agreed in the Brexit deal, data transfers between the UK and EEA are not considered transfers to a third country. However, this is only an interim measure, due to last until the end of April 2021, with an automatic extension until the end of June 2021 provided neither party objects.

Next Steps 

The European Data Protection Board (EDPB) will now assess and debate the draft adequacy decision and deliver its opinion (together with any amendments it sees fit) to the European Commission and the Member States in the coming months. If approved, the European Commission will then grant the adequacy decision.

If adopted, the decision will be initially valid for four years and will only be renewable if the UK protection levels continue to be adequate. 

Reaction 

The UK’s Information Commissioner, Elizabeth Denham, welcomed the draft adequacy decision, noting “draft adequacy decisions are an important milestone in securing the continued frictionless data transfers from the EU to the UK“ and that it “gets us a step closer to having a clear picture for organisations processing personal data from the EU”. 

However, a draft decision is only the next, albeit significant, step in the process. We will now need to wait for the EDPB and European Commission’s decisions and amendments on the draft adequacy decision. We will keep you posted on further developments.