News the European Commission has approved UK data adequacy decisions was today welcomed by the Law Society of England and Wales, as it heralds the continuation of the free flow of data from the European Economic Area (EEA) to Britain and Northern Ireland.
Law Society president I. Stephanie Boyce said:
“Data adequacy recognition from the EU means that personal data can continue to pass from the EEA to the UK without the need to introduce additional safeguards.
“This decision brings much needed certainty in the regulation of cross-border data transfers between the EEA and the UK. Having urged our members for some months to hope for the best but prepare for the worst on this issue we’re delighted with today’s outcome.”
Had the EU not determined the UK ‘adequate’, transfers of personal data from the EEA to the UK would have required those processing personal data to put in place appropriate safeguards or rely on exemptions provided in data protection law.
The Commission’s decision paves the way for police and judicial cooperation, allowing the continuation of data flows to combat serious crime and terrorism – vital for UK and EEA citizens.
I. Stephanie Boyce added:
“Despite this being positive news, we would nevertheless recommend that members regularly review their contingency planning. Though adopted, adequacy decisions are time-limited, subject to review, and may even be challenged in the future especially if the UK diverges from EU regulation.”
Notes
On the basis of Chapter V, Article 44-50 of the General Data Protection Regulation (GDPR), the European Commission can determine whether a country outside the EU provides an adequate level of protection for the personal data equivalent to that provided in European law – this then allows for the flow of personal data from the EEA to a third country without the need to adopt additional safeguards;
The Commission is in charge of carrying out the process of assessing the legal framework regarding personal data protection in a third country;
Among the criteria taken into account are: the rule of law, respect for human rights and fundamental freedoms; the existence and effective functioning of one or more independent supervisory authorities; and international commitments the third country has taken in relation to protection of personal data;
The EU-UK Trade and Cooperation Agreement (TCA) provided for a bridging mechanism for transfers of personal data between the EEA and the UK; the mechanism would have applied until 30 June 2021 but now ceased with the adoption of the adequacy decisions.