BCLP Global Data Privacy FAQs: What’s the current status of the UK Adequacy Decision?

UPDATE: The European Commission announced it had adopted two adequacy decisions for the UK on 28 June. We have written about the practical impact of this for businesses.

The European Commission published a draft Adequacy Decision for the UK on 19 February.  That document remains in draft, though it is understood to have successfully cleared the last formal approval stage required.

At the time of writing, flows of personal data from the EU to the UK are permitted on the same, seamless basis as pre-Brexit due to a temporary “bridging mechanism”.  That arrangement will expire at the end of June 2021 (at the latest) and, unless the European Commission adopts an Adequacy Decision for the UK, such data flows will then become subject to the restrictions imposed by the EU GDPR.

Adequacy Decisions may be made by the European Commission under Article 45 of the GDPR. For the UK, it will mean adding the UK to the “White List” of countries recognised as ensuring an adequate level of protection for personal data, including Canada, New Zealand and Japan.  Without it, EU data exporters sending data to the UK would have to use one of the transfer mechanisms prescribed in the EU GDPR, such as entering into standard contractual clauses (SCCs) with the UK entity importing the data.

The draft Adequacy Decision has been reviewed and commented upon by the European Data Protection Board (EDPB) jointly with the European Data Protection Supervisor (EDPS) and by the Civil Liberties, Justice and Home Affairs Committee of the European Parliament (the LIBE Committee).  Concerns were raised about aspects of UK data protection law and changes proposed by them to the draft prior to adoption. The Adequacy Decision is an “implementing act”, meaning that the European Commission needs to reconsider its draft in light of the comments at the various review stages but it does not require the approval of the European Parliament, the EDPB or EDPS.

 A positive vote of the EU member states is however required through the “comitology” procedure.  This requires the European Commission to consult a committee established under Article 93(1) of the GDPR in which each EU member state is represented.  Approval was reportedly obtained on 17 June 2021 which means that we can expect the UK Adequacy Decision will be adopted shortly and – hopefully - before the “bridging mechanism” expires on 30 June 2021.

This briefing is not legal advice.  Please contact any member of the Data Privacy & Security Team for further information.