On 19 February 2021, the European Union Commission issued a draft adequacy decision which, if implemented, will allow for the flow of personal data between the European Union and United Kingdom to continue as at present.
This will come as a considerable relief to those businesses and other organisations which regularly receive personal data from sources within the EU. Post-Brexit, the UK became a “third country” for the purpose of receiving personal data flows from the EU and in the absence of an adequacy decision the transfer of personal data from the EU to the UK would become subject to additional regulation and controls. This would require numerous organisations having to review their contractual arrangements with their European partners.
Although the 2020 transition period has ended and EU law no longer applies within the UK, the trade agreement which was ratified on 30 December 2020 grants a four-month grace period from 1 January 2021, during which data can continue to flow freely pending the approval of the UK as being an ‘adequate’ destination for personal data being transferred from the EU. There is currently an option for the grace period to be extended for a further two months, although this will not be necessary if the draft adequacy decision on the UK is adopted quickly.
What Does Adequacy Mean?
An adequacy decision means that the EU has accepted that the UK data protection regime affords adequate protection for EU data subjects. If the decision is adopted, data may continue to flow between the EU and UK as at present without the need for additional controls over the processing of personal data.
The draft decision must still be reviewed by the European Data Protection Board, however, and then needs final approval from the EU member states. EU states have previously expressed concerns regarding the so-called “Cloud Act” agreement which was signed in 2019 between the UK and the US and which was designed to facilitate a more seamless process for sharing personal data between UK and US law enforcement agencies, so approval is not currently guaranteed.
The Way Forward
If an adequacy decision has not been made by the end of the grace period, businesses will need to revisit their arrangements with EU entities with whom they exchange personal data. Such entities will need to demonstrate an alternative basis for continuing to transfer personal data to the UK. The alternative in most cases will be to put suitable contractual provisions in place in order to confirm that processing will only be undertaken in accordance with EU law and businesses will therefore need to revisit their existing contractual arrangements with EU parties. Hopefully, this will not be necessary, but businesses would be wise to monitor the progress of the draft decision over the next few weeks and identify which existing contracts may need to be revisited in the event that an adequacy decision is not achieved.
This article is provided by Burlingtons for general information only. It is not intended to be and cannot be relied upon as legal advice or otherwise. If you would like to discuss any of the matters covered in this article, please contact Andrew Pike or write to us using the contact form below.