European Commission launches process on personal data flows to UK

On 19 February 2021, the European Commission published its draft data adequacy decisions for the transfer of personal data to the UK. This includes two draft decisions for the adequate protection of personal data by the UK (i) under the GDPR and (ii) under the Law Enforcement Directive. 

If the draft decision is adopted, organizations in the EU will be able to continue to transfer personal data to organizations in the UK without relying upon data transfer mechanisms, such as the EU Standard Contractual Clauses, to ensure an adequate level of protection.

As a next step, the European Data Protection Board (EDPB) will issue its opinion on the draft decisions, before they can be approved by EU Member States and adopted. Until then, data flows between the EU/EEA and the UK will continue through the ‘data adequacy bridge’ that recognizes the UK as an adequate jurisdiction until 31 June 2021 under the EU-UK Trade and Cooperation Agreement. Should the draft EU decision be adopted, this temporary recognition will cease and instead the adequacy decision will apply.

FEDMA welcomes the draft Adequacy Decision issued by the Commission in respect of the UK as a fundamental step for many businesses transferring data across the channel.