Data controllers and data processors in both the UK and Europe are breathing a collective sigh of relief after the EU formally approved the UK's data adequacy status on Monday of this week (the formal adequacy decisions can be accessed here) simplifying the arrangements for transfers of personal data between the European Economic Area (EEA) and the UK.
Under the Brexit trade deal, the UK and EU agreed that personal data could continue to flow freely between the EEA and the UK for a longstop period of six months until the end of June 2021, while the EU considered adopting a permanent data adequacy decision. With such decisions historically taking a period of years and fresh concerns mounting that the decision might not be signed off after MEPs urged amendments to the February draft, completion of the process within the deadline is certainly welcome news.
What is the practical impact?
This decision means that personal data can continue to flow freely from the EEA to the UK, ensuring that EU-based data exporters and UK-based data importers do not need to fall back on alternative safeguards (typically) standard contractual clauses, in turn saving time and cost.
However, it is important to keep in mind that the decision is set to expire automatically on 27 June 2025 (unless it is extended) and that, in the meantime, the EU retains the general ability to withdraw adequacy status. Furthermore, adequacy decisions are susceptible to legal challenge, for example where there are concerns over the surveillance position under the UK's national security legislation, with third country adequacy decisions that the UK makes in its own right now that it has left the EU's approval process, or as a result of divergence from the European data protection regime as the UK forges ahead with its global innovation agenda and National Data Strategy.
For this reason, organisations are nevertheless advised to regularly assess and keep track of their data flows and associated arrangements, both in an intragroup context and with external third parties, to ensure that appropriate action can be promptly implemented in the event that adequacy is negatively affected for any reason.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
