- On 28 June the European Commission adopted two adequacy decisions on the United Kingdom, one under the GDPR and one under the law-enforcement directive.
- Personal data can flow from the EU to the UK without additional clauses or safeguards.
- The decisions have an initial validity of four years and the Commission can review them if British law changes.
On 28 June 2021 the European Commission adopted two decisions recognising that the United Kingdom offers an adequate level of personal data protection: one under the General Data Protection Regulation and the other under the Directive on data protection in the criminal field. Member States had voted in favour on 16 June and the European Data Protection Board had issued a favourable opinion. The trade agreement of December had provided for a transitional period of six months at most, until 30 June, during which data could keep flowing.
For Spanish and Catalan companies with customers, subsidiaries, suppliers or platforms in the United Kingdom, it means they can keep transferring personal data without resorting to alternative mechanisms, such as standard contractual clauses. It also avoids the United Kingdom becoming, after Brexit, an unrecognised third country, with the documentation and contracting costs that would have implied.
What an adequacy decision is
The GDPR allows personal data to be transferred outside the European Economic Area when the destination country offers a level of protection essentially equivalent to the European one, and it is the Commission that recognises this by an adequacy decision. When one exists, data flows as within the Union, without authorisations or additional safeguards. Before the United Kingdom, the Commission had recognised that level for countries such as Switzerland, Japan, Argentina or New Zealand.
In the British case, the analysis focused on the legislation derived from the GDPR itself, the 2018 data protection act, and on the rules on authorities’ access to data for national security and criminal investigation. The decision under the law-enforcement directive is the first of its kind, and allows police and judicial cooperation with exchange of personal data.
Validity and safeguards
The decisions have an initial validity of four years, after which they could be renewed if the level of protection remains adequate. The Commission will keep monitoring developments in British law and can intervene, suspend or repeal the decision if the United Kingdom drifts from the required level. This is relevant because the United Kingdom, outside the Union, is free to change its legislation in future, and recognition lasts only while the level of protection remains equivalent. For companies, that means the current peace of mind is real, but not permanent.
The GDPR decision does not cover data transferred for UK immigration control purposes, an area in which British law provides an exception to data subjects’ rights. In those cases, and in any other left outside, companies must keep using other mechanisms, such as the new standard contractual clauses adopted by the Commission on 4 June.
What to review
Companies with data flows to the United Kingdom should update their record of processing activities and their privacy notices, stating that the transfer relies on the adequacy decision. It is worth reviewing contracts with British providers of cloud, payroll or marketing services, and checking whether standard contractual clauses are still needed for onward transfers.
It is also worth noting the review date of the decisions and following legislative developments in the United Kingdom, because they may affect the validity of the framework. This information is general in nature and does not replace data protection advice for each specific case.
Good news for anyone working with the United Kingdom, but with a review date: keep the documentation up to date.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
