ANNOUNCED – DECISION OF UK ADEQUACY

On 19 February 2021, the European Commission has announced a draft adequacy decision in respect of the UK. The Commission concluded that the UK ensures a similar level of protection to the EU for personal data. This represents an essential step in ensuring that personal data can continue to flow freely from the EU to the UK following the UK’s exit from the EU.

Following Brexit, the UK was to be considered a third country for the purposes of the EU GDPR which means that an EEA organisation can only transfer personal data to the UK if it is covered by either (a) an adequacy decision; (b) appropriate safeguards (such as standard contractual clauses); or (c) one of the limited exceptions.

An adequacy decision is where the European Commission approves the legal framework in the country, territory, sector or international organisation to which the personal data is to be transferred as providing adequate protection for the rights and freedoms of individuals in respect of their personal data. This would be a significant relief for UK businesses as such decision would have resulted in additional costs to ensure the flow of data has appropriate safeguards resulting in costs to businesses being up to millions of pounds.

Now that a draft adequacy decision has been announced by the European Commission, there are two further steps the Commission has to take. First, the Commission will need to obtain an advisory opinion from the European Data Protection Board (EDPB). Second, the decision will be presented to EU member states for their formal approval. The last time the EDPB provided an opinion in respect to an adequacy decision (for Japan) the process took approximately four months.

It was hoped that the European Commission would reach an adequacy decision in respect of the UK prior to the end of the transition period, particularly as UK data protection laws are currently essentially in alignment with the EU GDPR in any case.

However, the European Parliament’s Civil Liberties Committee (CLC) reportedly backed a motion stating that the UK needed to reform its privacy standards prior to an adequacy decision being finalised and issued. The CLC has no formal part to play within the approval process, however its members may seek to influence the EU representatives whose approval is required to finalise the draft adequacy decisions.

It is also worth noting that Max Schrems, the Austrian privacy activist responsible for the litigation that invalidated the EU-US Privacy Shield, commented on 19 February 2021 that “there are obviously issues on UK government surveillance on EU data”. The Court of Justice of the European Union may once again be asked to determine the validity of the Commission’s decisions concerning data privacy rights.

The UK has strongly encouraged the EU to complete the final approval process as soon as possible so that data can continue to flow freely between the EU and UK. For now, it is a welcomed decision from the European Commission.

If you have any issues with data protection or any aspects intellectual property that you want to discuss or you want to have a more proactive approach to your IP, we at Briffa advises on all aspects of intellectual property law and practice and offers free 30-minute consultations to all new clients. If you would like to book a call or a meeting with one of our specialist IP lawyers, please contact hasnath@briffa.com or 020 7096 2779.

Written by Hasnath Ahmed, Associate