European Commission issues draft data adequacy decision for UK

The commission has concluded that the United Kingdom ensures an essentially equivalent level of protection to the one guaranteed under the General Data Protection Regulation (GDPR) and under the Law Enforcement Directive.

This paves the way for the continued free flow of personal data to and from the EU to the UK after a six-month, post-Brexit grace period ends in June. The decision will now be subject to “non-binding” opinion from the European Data Protection Board and approval from EU Member states before it can be fully adopted.

The decision will be valid for four years from the date of adoption, after which time the UK’s continued adequacy will be reassessed by the European Commission before renewal.

Didier Reynders, Commissioner for Justice, said: “A flow of secure data between the EU and the UK is crucial to maintain close trade ties and cooperate effectively in the fight against crime.

“Today we launch the process to achieve that. We have thoroughly checked the privacy system that applies in the UK after it has left the EU. Now European Data Protection Authorities will thoroughly examine the draft texts. EU citizens’ fundamental right to data protection must never be compromised when personal data travel across the Channel. The adequacy decisions, once adopted, would ensure just that.”

The UK government responded by welcoming the decision and called on the EU “to fulfil its declared commitment to complete the technical approval process swiftly, so that we have final data adequacy decisions as soon as possible”

Oliver Dowden, Secretary of State for Digital, said: “Although the EU’s progress in this area has been slower than we would have wished, I am glad we have now reached this significant milestone following months of constructive talks in which we have set out our robust data protection framework.”

Register for free to receive the latest privacy, security and data protection news and analysis straight to your inbox