The EU Commission has published two draft adequacy decisions for transfers of personal data to the UK, one under the GDPR and the other for the Law Enforcement Directive. This will be welcome news to many UK and EU businesses and, in the words of Věra Jourová, Vice-President for Values and Transparency, recognises that “ensuring free and safe flow of personal data is crucial for businesses and citizens on both sides of the Channel”.
Background
Following the end of the Brexit transition period, interim arrangements for data transfers from the EEA to the UK were agreed under the Trade and Co-operation Agreement (the TCA) signed on 24 December. As discussed in our previous briefing, this was essentially a ‘bridging’ solution in the hope that the EU would then adopt a formal adequacy decision allowing the continued free flow of personal data to the UK under the EU GDPR. The publication of the two draft adequacy decisions is the first step in the adoption process.
Next steps
The EU Commission will obtain an opinion from the European Data Protection Board (EDPB) and will then seek the green light from a committee composed of representatives of the EU Member States. Once this procedure is completed, the Commission could proceed to adopt the two adequacy decisions.
The UK government has welcomed the publication of the draft decisions and urged the EU “to complete the technical approval process swiftly”. Once adopted, the decisions would be valid for a first period of four years, after which they can be renewed if the level of protection in the UK continues to
be adequate.
Challenges remain
It is unclear how long the final steps will take until the adequacy decision is adopted and takes effect. In respect of Japan, the Commission published a draft decision in September 2018, the EDPB its opinion in December that year and the final adequacy decision was then adopted in January 2019. The interim arrangements under the TCA end on 30 June this year, assuming the agreed two-month extension period applies. It may be possible (based on the Japan timings for adoption), if a bit tight, for the decision in respect of the UK to be adopted before then and there will no doubt be significant pressure for this to happen given the inconvenience to businesses in putting place alternative arrangements in the event of a ‘gap’.
It is also likely that there will be a number of challenges to the EU Commission’s findings, however careful and thorough its assessment of the UK has been. The EDPB’s opinion will not be binding but the EU Commission will take account of it so it will be interesting to see what it says. In addition, the LIBE committee of the EU Parliament recently published a non-binding opinion stating that it is of the view that the UK ‘does not currently meet the conditions’ for adequacy. It lists a number of areas of concern, including the UK’s legal framework on the retention of electronic telecoms data and the broad exemption for processing personal data for immigration purposes. Although LIBE and the EU Parliament have no formal role in the adequacy process, the opinion may well exert some influence and, further down the line once the decisions are adopted, it could provide some fuel for challenges from privacy activists such as Max Schrems and NYOB.
Having said all that, there is no doubt that this is still a very positive development for businesses still grappling with the implications of Brexit (for further details see our previous briefing) during these tumultuous and challenging times.
