European Commission adopts UK data protection adequacy decisions

Following the withdrawal of the United Kingdom from the European Union, the European Commission has now confirmed that two data adequacy decisions proposed by the UK have been formally adopted. These decisions, relating to the GDPR and the Law Enforcement Directive, allow data to flow freely between the UK and EU essentially as before Brexit and will also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement (TCA).

Although the UK has retained the principles of the GDPR within its own Data Protection Act 2018 and currently remains compliant with the European legislation, there has been discussion within government recently on the future of UK data protection law, with Sir Iain Duncan Smith, chair of the Taskforce on Innovation, Growth and Regulatory Reform stating "GDPR is already out of date and needs to be revised for AI and growth sectors if we want to enable innovation in the UK." As such, the adoption of these decisions is reliant on the inclusion of “sunset” clauses which impose a four year limit on the decision, which will only be renewed if the UK maintains an adequate level of data protection in the future.

This announcement means that the UK has now avoided costly alternative plans with EU counterparts to keep data flowing once the post-Brexit transition period expires this month, with the commission claiming that the decision was reached in part because "The UK's data protection system continues to be based on the same rules that were applicable when the UK was a member state of the EU." adding that it would intervene if the UK deviates from the level of protection presently in place.

It is notable that the transfer of data for the purposes of UK immigration control are currently excluded from the scope of the adequacy decision adopted under the GDPR in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area, as reported in the June edition of the Advisory Debrief.