EU Commission publishes draft adequacy decision for UK

Last week, the European Commission submitted two draft decisions granting data adequacy to the UK.

After months of scrutinising UK law and practice on personal data protection, the Commission has found the UK to have an essentially equivalent level of protection to the one guaranteed under the GDPR and the Law Enforcement Directive. A decision of data adequacy is important because it means transfers of personal data from the EU to non-EU countries (the UK) can take place without being subject to any further conditions. Data flows from the UK to EU are regulated by UK legislation and are not relevant here.

Vice President of the European Commission for Values and Transparency Věra Jourová highlighted the significance of a data adequacy decision for businesses and citizens on both sides of the Channel, stating: “The UK has left the EU, but not the European privacy family. The UK’s continued commitment to the ECHR and Convention 108 of the Council of Europe, the only binding multilateral instrument on data protection, means the UK can remain a member of the European “privacy family” despite Brexit.

For the Commission to be able to adopt the two adequacy decisions, the @EU_EDPB will now need to provide an opinion, as well as approval from representatives of EU countries. 

The decisions, once adopted, will be valid for 4 years, followed by a possibility to renew so long as the Commission finds the level of UK protection adequate. The first 4 year period is to ensure that the adequacy decision is future-proof from possible divergences in law which may arise from the UK being no longer bound by EU privacy rules due to Brexit.

Click here to read the draft decisions and the Comission's statement.

European Institute analysis:

This news follows two European Institute reports on the consequences of the EU's decision on data adequacy. In May 2020, our policy paper predicted that the EU would likely grant the UK an adequacy decision. 

May 2020: EU-U.S. Privacy Shield, Brexit and the Future of Transatlantic Data Flows (Policy Paper)

This report analysed the issues raised by EU-U.S. commercial data flows, including the future status of the Privacy Shield framework and standard contractual clauses (SCCs). It begins by comparing the systems of data protection in the EU and the U.S., highlighting key philosophical, legal and practical differences. In it, the authors predicted that the UK would be granted data adequacy by the EU:

The European Commission will likely grant the UK an adequacy decision. The flexibility and pragmatism which the Commission has demonstrated towards the U.S. indicates this.

Authors:

Oliver Patel - Research Associate, UCL European Institute
Dr Nathan Lea - Senior Research Associate, UCL Institute of Health Informatics

Read the policy paper

October 2020: EI research contribution to House of Lords report

EI research on data transfers featured significantly in a major House of Lords report on Brexit. In October, the House of Lords Committee published their major report on the topic: The future UK-EU relationship on professional and business services. The report set out the committee's priorities and concerns for a UK-EU free trade agreement, and repeatedly referenced the EI research in its chapter on Digital trade and data flows:

We are alarmed about the lack of an EU decision on the data adequacy of the UK framework and the absence of most decisions on financial services equivalence and audit adequacy. We call on the Government to push for these assessments to be concluded as soon as possible, to give businesses in the UK and EU legal certainty and time to prepare.

Read more here

November 2020: The Cost of Data Inadequacy (Report with NEF)

This landmark report, with the New Economics Foundation, outlined the economic cost and implications of the UK not receiving an adequacy decision from the EU. We looked at the impact on businesses, different economic sectors, and the wider economy. We believe that this is the first comprehensive report analysing this issue from an economic perspective.

Authors:

Oliver Patel - Research Associate, UCL European Institute
Duncan McCann - Senior Researcher, New Economics Foundation
Javier Ruiz - Digital Policy Consultant, independent

Read the report