On 14 April the European Data Protection Board (EDPB) announced its opinion on the European Commission's draft adequacy decisions in relation to the UK, on which we reported in the February 2021 issue of DWF Data Protection Insights. If granted, the decisions will make the continued flow of data between the EEA and the UK much easier following the expiry of 'the bridge', which is the temporary mechanism included in the Trade and Cooperation Agreement (TCA) announced just before Christmas 2020 and which is due to expire at the end of June 2021.
The EDPB noted that the UK data protection framework at present broadly mirrors the EU framework. However, it commented that, whilst laws can evolve, this alignment should be maintained, so it welcomes the Commission's decision to limit the adequacy decisions to four years and closely monitor developments in the UK. The EDPB also stated that a number of items should be further assessed and/or closely monitored by the Commission in its decision based on the GDPR, including:
- the immigration exemption in the Data Protection Act 2018 and its consequences on restrictions on data subject rights; and
- the application of restrictions to onward transfers of EEA personal data transferred to the UK, e.g. on the basis of future adequacy decisions adopted by the UK, international agreements concluded between the UK and third countries or derogations.
As we reported in the March 2021 issue of DWF Data Protection Insights:
- the Department for Digital, Culture, Media & Sport (DCMS) and the Information Commissioner's Office (ICO) have signed a Memorandum of Understanding setting out the procedure which the UK will follow when adopting future adequacy decisions; and
- Oliver Dowden, the Secretary of State for DCMS, has expressed an intention to 'rebalance' data protection rules to open up greater economic opportunity.
These factors show why the European Commission and the EDPB are keen to put a time limit on the UK's adequacy decisions and monitor developments. We recommend that organisations continue to plan for the possibility that the adequacy decisions, if granted, could be invalidated following a legal challenge or may not be renewed following the expiry of the initial four-year period.
If you would like advice on any aspect of international data transfers, including those between the UK and the EEA and between the UK and other countries, please contact one of our data protection specialists.
