Government welcomes European Commission’s draft data adequacy decision

The European Union (EU) already recognises other countries around the world – among them Argentina, Canada, Israel, Japan, New Zealand, Switzerland and Uruguay – as being adequate in relation to data issues and, indeed, the UK freely exchanges data with these nations.

Positive data adequacy decisions under both the EU’s General Data Protection Regulation (GDPR) and the Law Enforcement Directive would allow for personal data to continue to flow freely from the EU and the wider European Economic Area (EEA) to the UK.

Seamless international data flows are essential in a hyper-connected world. They underpin the exchange of information and ideas supporting trade, innovation and investment, assist with law enforcement agencies tackling crime and support the delivery of critical public services sharing personal data as well as facilitating health and scientific research.

Technical confirmation of the draft adequacy decisions will help make sure UK businesses and organisations operating in areas from logistics to legal services and healthcare through to HR can continue to receive personal data from the EU and the EEA without additional compliance costs. This ensures they will avoid potential knock-on effects for consumers and boost UK start-ups and smaller firms presently operating in EU markets and selling to EU-based customers.

Adequacy assessment

The UK formally provided the European Commission with comprehensive explanatory material nearly a year ago at the start of the adequacy assessment in March 2020. The UK has already recognised the EU and EEA Member States as ‘adequate’ as part of the commitment to establish a smooth transition for the UK’s departure from the bloc and manage data flows on an objective basis.

Since then, UK officials led by those from the Department for Digital, Culture, Media and Sport have held a series of discussions with their European Commission counterparts to reiterate carefully and fully the UK’s legal and regulatory framework and demonstrate beyond doubt that the UK clearly meets the EU’s data adequacy requirements.

The draft decisions published by the European Commission will now be shared with the European Data Protection Board for a ‘non-binding opinion’ before being presented to EU Member States for formal approval.

The UK made its representations to the EU in a timely manner, but the Commission did not finalise draft decisions in time to complete the adoption process by the end of the transition period. For this reason, as part of the UK/EU Trade and Co-operation Agreement, a time-limited ‘bridging mechanism’ for personal data flows was agreed. This currently allows personal data to continue to flow as it did before the end of the Brexit transition period for up to six months while the EU completes the adequacy process.

Technical process

The Government is now urging the EU to swiftly complete the technical process for adopting and formalising these adequacy decisions as early as possible.

Oliver Dowden, Secretary of State for Digital, explained: “I welcome the publication of these draft decisions which rightly reflect the UK’s commitment to high data protection standards and pave the way for their formal approval.

Although the EU’s progress in this area has been slower than we would have wished, I’m glad we’ve now reached this milestone following months of constructive talks in which we’ve set out our robust data protection framework.”

Dowden added: “I would now urge the EU to fulfil its commitment to complete the technical approval process promptly such that businesses and organisations on both sides can seize the clear benefits.”

Julian David, CEO of techUK, commented: “The European Commission’s decision that the UK’s data protection regime offers an equivalent level of protection to the EU GDPR reflects the UK’s high data protection standards. This decision is warmly welcomed by the tech sector which has been making clear the importance of a mutual data adequacy agreement since the day after the EU referendum.”

David concluded: “Alongside the EU-UK Trade and Co-operation Agreement, receiving data adequacy will set a solid foundation for digital trade with the EU, including strong non-discrimination clauses and positive data flow provisions that will afford businesses the confidence to invest.”

Charlotte Clark, director of regulation at the Association of British Insurers, stated: “We very much welcome the European Commission’s draft decision on data adequacy to allow the continued free flow of data between the UK and the EU. We have long pressed for such an approach It’s the most legally sound way of sharing personal data. From this point, we do hope that the process to formally adopt the decision will be swift.”