In a solid step forward for EU to UK personal data transfers, the European Commission has published its draft adequacy decision that will (if finally adopted) permit personal data to flow freely from the EU to the UK. As we wrote in January (when the UK's exit from the EU took practical effect), the EU agreed to continue to let personal data flow to the UK for a temporary period while the adequacy of the "UK GDPR" was under evaluation. (The UK had already committed to allowing UK personal data to be transferred to the EU freely on the basis that the EU's GDPR provides adequate protection for the transferred data.)
The Commission's adequacy decision was expected, but the draft decision still needs to go through review by the European Data Protection Board and others before it can be adopted. As we commented previously, now that the UK is no longer in the EU, it's possible that EU decision-makers will raise objections on the basis of the UK's national surveillance laws, as they have in the case of the US. A reciprocal adequacy decision is not guaranteed.
The draft Commission adequacy decision is here and the UK Information Commissioner's brief statement welcoming the draft decision is here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
