UPDATE: European Commission issues UK data adequacy decision

The European Commission has announced (on 28 June 2021) that it has adopted two adequacy decisions for transfers of personal data to the UK

The new adequacy decisions have been adopted under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED).

This confirms the EU’s acceptance that the UK’s data protection regime is substantially equivalent to the EU regime and allows personal data to flow freely from the EU and wider European Economic Area (EEA) to the UK. This announcement has been welcomed by the UK government and is good news for both the UK and EU and EEA businesses which depend on the ongoing transfer of data to the UK, particularly those in the insurance, health, and technology sectors. Failure to secure an adequacy decision, would, it is estimated, have cost UK business upwards of £1.6billion. The UK has previously recognised the EU and EEA member states as adequate.

The formal adequacy agreement will run for four years after which it will be subject to review and extension if the level of data protection in the UK continues to be adequate. The EC will continue to monitor the legal situation in the UK during these four years and could intervene at any point. The temporary interim provision under the Brexit Trade Deal has now come to an end, as the final adequacy decision has been issued by the EC.

Following the end of the Brexit transition period, the UK data processing regime is now governed by the UK GDPR and the Data Protection Act 2018, which are derived from and almost identical in substance to the EU GDPR and the LED. The EU has also issued adequacy decisions to other third nations including, Argentina, Canada, Israel, Japan, New Zealand, Switzerland and Uruguay.