UK data protection ‘adequacy’ gets EU governments’ sign-off

Prior to Brexit the UK was automatically considered as being aligned to EU data protection standards, but the EU deemed that a fresh assessment was required after the Brexit transition period ended. Transitional arrangements were agreed alongside the EU-UK Trade and Cooperation Agreement reached in late 2020 to allow personal data to continue to flow freely from EU member states to the UK in the short-term, but there had been uncertainty over the longer-term position.

However, in February, the European Commission issued draft ‘adequacy decisions’ with a view to facilitating the continued free flow of personal data from the EU to the UK.

Countries that benefit from an adequacy decision are considered to have laws essentially equivalent to those that safeguard personal data inside the European Economic Area. Where an adequacy decision has been issued, data transfers between the EU and those third countries – of which, from the EU’s perspective, the UK is now one – are said to be compliant with EU data protection laws.

Canada, Switzerland and New Zealand are among the countries that benefit from a Commission adequacy decision, and, in addition to nearing the completion of an adequacy decision for the UK, the Commission recently announced that it plans to adopt a new adequacy decision in respect of South Korea.

The Commission’s draft adequacy decisions for the UK have to be formally approved by representatives of EU member state governments, and are also subject to a non-binding opinion of the European Data Protection Board (EDPB). German online publisher NetzPolitik reported on Thursday that EU member states had “voted unanimously in favour” of the UK adequacy decision. Reuters and EurActiv are among the other media to report the news.

The endorsement of EU member states paves the way for the Commission to finalise the UK’s adequacy decisions before the end of June, when the current transitional arrangements in respect of EU-UK personal data flows expire.

For data transfers from the UK to the EU, the UK government had already confirmed these are authorised to continue until at least 2024.

Data protection law expert Kathryn Wynn of Pinsent Masons, the law firm behind Out-Law, had previously highlighted that uncertainty over EU-UK data flows was one of the biggest issues for businesses to deal with coming out of Brexit.

Wynn said in February: “Not knowing whether the EU would grant data adequacy to the UK has forced some companies to put on hold data innovation projects and instead retain some budget to potentially introduce new safeguards for EU-UK data transfers in order to comply with EU data protection laws in the event an adequacy decision was not granted."