UK One Step Closer to EU Adequacy Determination

On Friday, February 19 2021, the European Commission published a draft adequacy decision (the "Draft Decision") recognising the UK's high standards of data protection (Click here).  Although we are not quite at formal adequacy, the announcement of the Draft Decision brings us markedly much closer.

Pursuant to Article 45(3) of the General Data Protection Regulation 2016/679 ("GDPR") and Article 36(3) of Directive (EU) 2016/680 (i.e., the Law Enforcement Directive) the European Commission has the power to decide that the UK (a third country), through an implementing act, provides a level of protection to personal data that is essentially equivalent to EU standards.

The UK began the process of providing the European Commission with explanatory materials regarding the adequacy assessment process back in March 2020. Although the process has taken some time, the wait seems to have been worthwhile and is a welcome outcome for the UK and businesses relying on the free-flow of data between the UK and the EU.

As mentioned in our post earlier this year (Click here), the Trade and Cooperation Agreement (the "Brexit Agreement") between the EU and UK provided for a period of up to six months, during which the UK will not be treated as a third country, rather as an adequate jurisdiction thus allowing data to flow freely. If the Draft Decision is formally adopted, this temporary recognition will cease and instead the adequacy decision will apply.

The free flow of personal data is a fundamental component to the exchange of information for all businesses and the flow between the EU and UK has been acknowledged as a core feature in helping to shape the UK's relationship with the EU post-Brexit. Business operators can therefore breathe a sigh of relief as the announcement of the Draft Decision suggests a formal adequacy decision will be adopted before expiration of the specified period.  The Draft Decision will now be shared with the European Data Protection Board for the publication of a non-binding opinion. As part of the technical approval process, it will also be provided to representatives of the EU Member States for formal approval.

The announcement of the Draft Decision is undoubtedly a significant step towards ensuring the continued free flow of data and securing an environment of business cooperation between the EU and the UK. However, it is important to note that any formal adequacy decision ultimately adopted by the European Commission will be open to the same scrutiny and challenge as that of the EU-US Privacy Shield, invalidated by the CJEU in the Schrems II decision last year (Click here).  The UK will have to keep a close eye on developments in the EU data protection regime and ensure it maintains appropriate level of protection in order to avoid the same fate.