Another positive step towards data adequacy status was reached in February with the publication of the European Commission’s draft adequacy decision. Further progress was made towards UK data adequacy status with the publication of the European Data Protection Board’s (EDPB) Opinion on 13 April on the European Commission’s (EC) draft adequacy decision.
The Opinion agreed with the EC’s assessment that the UK's law and practice on personal data protection under the General Data Protection Regulation (GDPR) does ensure a degree of personal data protection equal to that offered by European law.
This is good news for UK businesses with data flows between the EU and the UK, who are all too aware of the impending 30 June 2021 deadline when the adequacy bridge agreed in the 2020 Trade And Cooperation Agreement is set to expire.
While non-binding, the Opinion outlined several areas of concern that the European Commission should monitor, particularly:
- The UK Data Protection Act’s immigration exemption, believed to restrict data subjects’ rights.
- Onward transfers of personal data sent to the UK, then transferred to a third country.
The next step is for the European Council to send the draft decision to EU Member States for formal approval. The EC will then adopt a final decision on UK adequacy, which will remain valid for four years.
This article was produced by CELIA member firm Abbiss Caddres.