International data transfers: European Commission poised to grant UK adequacy decision

Insight

18.02.2021

Further to our bulletin last month which explained how the EU-UK Trade and Co-operation Agreement includes a temporary “bridging mechanism” to allow the lawful transfer of personal data from the EU to the UK, the Financial Times reports this week that it has seen a draft decision of the European Commission which grants an “adequacy decision” to the UK.

The European Commission’s draft decision will now be passed to the European Data Protection Board for comment and any (non-binding) recommendations they have; and it will then need approval from a committee of the EU Member States before final sign off by the European Commission. Nevertheless, the existence of a UK adequacy decision, even in draft, is good news and represents swift progress against the four month (extendable to six month) period / deadline for replacing the EU-UK Trade and Co-operation Agreement’s “bridging mechanism”.

This means that the UK will join the likes of Israel, Switzerland, and most recently Japan as one of the “third countries” which the European Commission has declared to be a safe place to send personal data from the EEA, in accordance with the EU GDPR’s strict rules about international data transfers. The full list of European Commission adequacy decisions can be found here.

All of these adequacy decisions are subject to periodic review and indeed the European Commission is already revisiting its older adequacy decisions in light of the CJEU’s July 2020 decision in the “Schrems II” case (in which another European Commission “adequacy decision” – in respect of the EU-US Privacy Shield regime – was successfully challenged and the Court declared the Privacy Shield invalid). We wrote about the Schrems II case and its impact for both the Privacy Shield and the Standard Contractual Clauses data transfer mechanisms here and here).

For now, though, the European Commission’s adequacy decision for the UK will be great news for all organisations which transfer personal data from the EU / EEA to the UK. Data transferring in the other direction already has a lawful basis because the UK has declared the EU / EEA countries as being adequate for the purposes of the UK GDPR. The European Commission’s decision to grant the UK an adequacy decision will allow all data flows across the English Channel to continue essentially as they did before the UK left the EU.

If you require further information about anything covered in this briefing, please contact Alan Baker, or your usual contact at the firm on +44 (0)20 3375 7000.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.