When the UK left the single market at the end of last year, a maximum 6 month interim period provided for in the EU-UK agreement was automatically activated. This allows personal data to flow freely until a more permanent solution is found.
The Commission launched a process towards the adoption of an adequacy decision for the transfer of personal data to the UK under GDPR. The decision could have been made before 31 December, had the case of the UK been more straightforward. There seems to have been concerns regarding the access of UK public authorities to data, as well as concerns regarding the surveillance regime on the other side of the Channel. Consideration also needed to be given to the 2020 Schrems II judgement of the EU Court of Justice, which brought down the agreement with the US.
The above concerns seem to have been put to rest by the Commission. On 19 February it adopted a draft EU-UK adequacy decision for the transfer of personal data under GDPR. Nevertheless, some concerns remain, both from MEPs and the European Data Protection Board (EDPB), regarding the UK’s data transfer agreement with the US, signed in October 2019. These issues are related to worries that the adequacy decision between the EU and the UK could represent a way for the US to access EU data.
The EDPB will now be asked to provide a non-binding opinion on the decision. On this basis, the Commission could decide to amend the draft text. Subsequently, the decision will go through a specific procedure (called “comitology”) to get the approval from representatives of Member States. If approved, the Commission will proceed to the final adoption. The decision will be re-examined every four years, to make sure that the UK rules adopted after the adequacy decisions will not represent a threat for EU citizens’ privacy.
On this topic, Věra Jourová, Commission’s vice-president for values and transparency, said the Commission would monitor the evolution of the UK data protection framework. Should the UK diverge from EU standards, decisions could be withdrawn.
The transfer of personal data between the EU and UK takes place under the above-mentioned interim regime until the Commission adopts the adequacy decisions. If this does not happen by the 30 of June 2021 expiration date of the interim regime, the UK will be considered a third country and transfer mechanisms, such as standard contractual clauses, would have to be used when transferring data to the UK.
By Antoine Kremer and Sofia Badari