Data transfers to the EU: Update

European Union governments have agreed that UK standards for data protection are sufficiently high to allow personal data to be transferred freely from the EU to the UK. This is one of the last, but key, steps towards the UK receiving an adequacy decision.

Adequacy Decisions

The agreement will make it possible for the European Commission to adopt two adequacy decisions.  These will enable a smooth transition following the end of the six-month transitional agreement under the EU Trade and Cooperation Agreement and will allow the continued free flow of personal data from the EU to the UK.

When the European Commission approves an adequacy decision it, in effect, indicates that the country which benefits from the decision has data protection laws essentially equivalent to those of the EU (under the GDPR). The EU governments’ approval allows for the adequacy decision to be finalised before the end of June (when the current arrangements end) and facilitate the transfer of personal data from the EU to the UK. 

For data transfers from the UK to the EU, the UK government has confirmed that these will continue until at least 2024. 

The UK will join countries such as Canada, Switzerland and New Zealand who already benefit from adequacy decisions.

Next Steps 

The Commission’s draft adequacy decision will now be subject to formal approval by representatives of each Member State. In April, it was reported that the European Data Protection Board had taken a broadly positive view of the draft adequacy decision published by the Commission. NetzPolitik and Reuters have reported that the EU Member States have “voted unanimously in favour” of the adequacy decision. 

Comment 

The adequacy decision will be a relief for UK organisations that work within the EU. It helps to solve one of the big issues facing businesses following the UK’s withdrawal from the EU. While it is a great comfort going forward, businesses must remain vigilant. The decision will need to be renewed after four years. It appears, therefore, that the European Commission will be keeping a close eye on UK data protection standards and the decision itself may be subject to adjustments in the future. Any large scale divergence from the GDPR by the UK is therefore unlikely for the foreseeable future.