On February 19, 2021, the European Commission published a draft decision on the adequacy of data protection in relation to the United Kingdom. If the draft decision is adopted, organizations in the EU can continue to transfer personal data to organizations in the UK without restriction and do not have to rely on data transfer mechanisms such as the EU Standard Contractual Clauses to ensure adequate levels of protection.
In making the decision, the European Commission spent about a year analyzing the UK data protection framework and concluded that the UK legal and regulatory data protection regime met EU data adequacy requirements.
In a first draft of EU adequacy decisions, the UK draft decision includes a provision requiring an automatic review of the adequacy of the UK legal system within four years. If after this time the UK’s adequacy has not been reconfirmed by the European Commission, the adequacy decision will be forfeited and the UK will no longer be considered fair.
The EU and the UK have previously agreed a transition period of 1 January 2021 for a period of up to six months, during which the UK will be treated as an appropriate jurisdiction, under the EU-UK Trade and Cooperation Agreement. If the draft decision is adopted, that temporary approval will be suspended and the adequacy decision will apply instead.
Before the decision is officially adopted, the European Data Protection Board will issue a non-binding (albeit likely convincing) opinion on the decision. The European Parliament’s Committee on Civil Liberties will also issue a non-binding opinion on the decision. The decision will be officially adopted after it has been approved by the EU Member States acting through the European Council.
The UK government issued a statement welcoming the decision.