On 28 June 2021, the European Commission issued two adequacy decisions in respect of the UK – one under Regulation (EU) 2016/679 (the EU’s General Data Protection Regulation, or EU GDPR) and another under Directive (EU) 2016/680 (the Law Enforcement Directive).
Amongst other things, this means that transfers of personal data from the EU to the UK may continue without any “transfer mechanism” therefore under the EU GDPR (e.g., standard contractual clauses, binding corporate rules or other mechanisms provided for in Articles 46-49 of the EU GDPR), subject to two important caveats:
- The decisions contain a so-called “sunset clause” which limits their duration to a period of four years. This means that the decisions will automatically expire on 27 June 2025 unless they are renewed by the European Commission
- Transfers of personal data for the purposes of UK immigration control are excluded from the scope of the adequacy decision adopted under the EU GDPR, in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area. The European Commission has said that it will reassess the need for this exclusion once the situation has been remedied under UK law. Until then, these transfers will need to be carried out on the basis of a valid transfer mechanism under the EU GDPR
The press release issued by the commission (which includes links to the decisions themselves) can be found here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_3183.
The UK’s Information Commissioner’s statement in respect of the decisions can be found here: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/06/ico-statement-in-response-to-the-eu-commission-s-announcement-on-the-approval-of-the-uk-s-adequacy/.
