By Patrick Wheeler, ECTA Data Committee Member, Collyer Bristow (UK)

The European Commission (EC) has started the process for the adoption of two adequacy decisions for transfers of personal data from the EU/EEA to the UK, under both the GDPR and the Law Enforcement Directive - Data protection: draft UK adequacy decision (europa.eu). The UK has already declared adequacy for the EU/EEA in respect of transfers out of the UK.

There are procedures to monitor and review these EC decisions to ensure that UK laws do not diverge from the GDPR.

These decisions still require to be thoroughly reviewed by the European Data Protection Board (EDPB), representing the various EU Data Protection authorities. It cannot be assumed that the EDPB will simply rubber stamp the EC decisions, but both sides are obviously now much more hopeful that approval will be given.

The temporary current arrangement from the trade deal between the EU and UK regarding the transfer of data will continue until 30 April and can be extended until 30 June, so the EDPB will be strongly encouraged to report back to the EC quickly, so the EC can proceed and hopefully make an adequacy decision by either the earlier or the later date.

If adequacy is granted, then the decision will last for 4 years initially, with the option to renew beyond that period.

----

The views expressed are those of our members and not necessarily of ECTA as an association. The content has not been subjected to a verification process, the accuracy of the information contained in the article is responsibility of the author.