The European Commission has announced today that it has formally launched the adoption process for two adequacy decisions concerning the transfer of EU personal data to the UK. The decisions cover data transfers in relation to the General Data Protection Regulation and the Law Enforcement Directive. Companies will be relieved that transfers of customer and employee data from across the channel will largely be subject to the same conditions required pre-Brexit. Data can also continue to be shared between countries for law enforcement purposes.
The EU's data protection authorities will now be asked to review the Commission's draft decisions and collectively provide their opinion through the European Data Protection Board before Member States are then asked to ratify them before the final adequacy decisions are adopted. Once adopted, these decisions will be valid for a period of four years, at which point the decisions can be further renewed. In the meantime, EU to UK data flows will continue to be subject to the provisions of the EU-UK Trade and Cooperation Agreement which expires at the end of June 2021.
Didier Reynders, Commissioner for Justice, said: “A flow of secure data between the EU and the UK is crucial to maintain close trade ties and cooperate effectively in the fight against crime. Today we launch the process to achieve that. We have thoroughly checked the privacy system that applies in the UK after it has left the EU. Now European Data Protection Authorities will thoroughly examine the draft texts. EU citizens' fundamental right to data protection must never be compromised when personal data travel across the Channel. The adequacy decisions, once adopted, would ensure just that.”