What has happened?
- The European Commission has published its draft decision on February 19, 2021 granting data protection adequacy status to the UK under Article 45(3) of the GDPR.
- The draft decision is currently under review by the European Data Protection Board, which will issue its opinion (not binding) in the coming weeks.
- For the draft decision to be adopted as final, it will still have to be approved by a committee of representatives of EU Member States.
What are the main implications of this draft decision?
The UK left the EU on January 31, 2020. The EU Trade and Cooperation Agreement established the free flow of personal data from the EU to the UK during a transition period of up to six months. If within that timeframe the European Commission adopts a decision declaring the adequacy of the UK, the transition period will terminate and the free flow of data from the EU to the UK will continue.
However, if the six months of the transition period elapse without an adequacy decision from the European Commission having been adopted, companies would need to implement a transfer mechanism under GDPR (i.e., Standard Contractual Clauses, Binding Corporate Rules, etc.) to be able to transfer data from the EU to the UK. This would certainly imply an additional compliance burden for businesses at both sides of the channel.
Therefore, the draft decision is very welcome since it represents a first and very important step towards allowing that the free flow of data from the EU to the UK continues after the transition period.
Once adopted, can the decision be challenged?
The decision once adopted potentially can be challenged as happened with the Safe Harbour and more recently with the Privacy Shield following the Schrems II case. In fact, members of the European Parliament have already shown their criticism with this draft decision. However, it is too soon to foresee if this is going to be the case. It will be interesting to see the opinion of the European Data Protection Board about the draft decision.
Can companies already rely on the draft decision to transfer personal data from the EU to the UK?
No. As mentioned above, the decision is still a draft and still needs to be approved by representatives of the EU Member States before it is finally adopted by the European Commission.
What’s next?
The adoption of an adequacy decision involves: (a) a proposal from the European Commission, (b) an opinion of the European Data Protection Board, (c) an approval from representatives of EU countries and (d) the adoption of the decision by the European Commission. So far only step (a) has been completed, and we need to wait for the opinion of the European Data Protection Board for the process to adopt the final decision to move forward.
