Breaking News - Data Protection provisions for the UK & EU - EU Adequacy Decision Confirmed.

The Government and European Commission announced on 28 June that EU Commission has adopted two adequacy decisions including one under the EU GDPR, which means that personal data will continue to be allowed to flow freely from the EU and the wider European Economic Area to the UK following the UKs departure from the EU.

The UK adopted the EU GDPR in 2018 while still a member of the European Union.  This allowed for the free flow of personal data within the EU and wider European Economic Area (EEA), so businesses and organisations within the UK could transfer personal data to EU/EEA countries and vice versa.

But the UK's departure from the EU, completed on 31 December 2020 left this position at risk, as the continued free flow of data relied on the EU making a ruling that that UK data provisions were adequate to continue to allow EU/EEA countries to transfer data to the UK. Other non-EU countries have been able to secure similar arrangements with the EU.

When the UK finally fully left the EU on 31 December 2020, the terms of the EU-UK Trade and Cooperation Agreement provided a six-month temporary extension to the data arrangements with the EU, which have allowed for the ongoing transfer of personal data from the EU to the UK.  However, that agreement was due to expire on 30 June 2020.

The UK announced earlier this year an adequacy decision recognising the EU's data provisions, which has meant that businesses and organisations have been able to freely transfer personal data to the EU/EEA countries without additional measures.

The EU's adequacy decision announced on 28 June means that the EU similarly recognises that the data protection provision in the UK are in line with the EU provisions and that businesses and organisation in the EU can continue to transfer personal data to the UK. 

This adequacy decision will automatically expire in four years and will need to be renewed at that time, but it could also be ended earlier if the UK departs from the protections currently in place for the transfer of personal data.

Given that the temporary arrangement was due to end imminently, this decision will be welcomed by businesses and organisations in the UK in allowing them to continue to do business with EU/EEA countries without needing additional measures to manage the flow of personal data.

Read the Government update.