Data protection: Commission adopts adequacy decisions for the UK

(Credit: Unsplash)

This article is brought to you in association with the European Commission.


The Commission has today adopted two adequacy decisions for the United Kingdom – one under the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive. Personal data can now flow freely from the European Union to the United Kingdom where it benefits from an essentially equivalent level of protection to that guaranteed under EU law. The adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters. Both adequacy decisions include strong safeguards in case of future divergence such as a ‘sunset clause’, which limits the duration of adequacy to four years. 

Věra Jourová, Vice-President for Values and Transparency, said: “The UK has left the EU but today its legal regime of protecting personal data is as it was. Because of this, we are adopting these adequacy decisions today. At the same time, we have listened very carefully to the concerns expressed by the Parliament, the Members States and the European Data Protection Board, in particular on the possibility of future divergence from our standards in the UK’s privacy framework. We are talking here about a fundamental right of EU citizens that we have a duty to protect. This is why we have significant safeguards and if anything changes on the UK side, we will intervene”.

Didier Reynders, Commissioner for Justice, said: “After months of careful assessments, today we can give EU citizens certainty that their personal data will be protected when it is transferred to the UK. This is an essential component of our new relationship with the UK. It is important for smooth trade and the effective fight against crime. The Commission will be closely monitoring how the UK system evolves in the future and we have reinforced our decisions to allow for this and for an intervention if needed. The EU has the highest standards when it comes to personal data protection and these must not be compromised when personal data is transferred abroad.”

Key elements of the adequacy decisions

  • The UK’s data protection system continues to be based on the same rules that were applicable when the UK was a Member State of the EU. The UK has fully incorporated the principles, rights and obligations of the GDPR and the Law Enforcement Directive into its post-Brexit legal system.
  • With respect to access to personal data by public authorities in the UK, notably for national security reasons, the UK system provides for strong safeguards. In particular, the collection of data by intelligence authorities is, in principle, subject to prior authorisation by an independent judicial body. Any measure needs to be necessary and proportionate to what it intends to achieve. Any person who believes they have been the subject of unlawful surveillance may bring an action before the Investigatory Powers Tribunal. The UK is also subject to the jurisdiction of the European Court of Human Rights and it must adhere to the European Convention of Human Rights as well as to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, which is the only binding international treaty in the area of data protection. These international commitments are an essential elements of the legal framework assessed in the two adequacy decisions.
  • For the first time, the adequacy decisions include a so-called ‘sunset clause’, which strictly limits their duration. This means that the decisions will automatically expire four years after their entry into force. After that period, the adequacy findings might be renewed, however, only if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place. Should the Commission decide to renew the adequacy finding, the adoption process would start again.
  • Transfers for the purposes of UK immigration control are excluded from the scope of the adequacy decision adopted under the GDPR in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area. The Commission will reassess the need for this exclusion once the situation has been remedied under UK law.

Background

On 19 February, the Commission published two draft adequacy decisions and launched the procedure for their adoption. Over the past months, the Commission has carefully assessed the UK’s law and practice on personal data protection, including the rules on access to data by public authorities in the UK. The Commission has been in close contact with the European Data Protection Board, which gave its opinion on 13 April, the European Parliament and the Member States. Following this in-depth process, the European Commission requested the green light on the adequacy decisions from Member States’ representatives in the so-called comitology procedure. The adoption of the decisions today, following the agreement from Member States’ representatives, is the last step in the procedure. The two adequacy decisions enter into force today.

The EU-UK Trade and Cooperation Agreement (TCA) includes a commitment by the EU and UK to uphold high levels of data protection standards. The TCA also provides that any transfer of data to be carried out in the context of its implementation has to comply with the data protection requirements of the transferring party (for the EU, the requirements of the GDPR and the Law Enforcement Directive). The adoption of the two unilateral and autonomous adequacy decisions is an important element to ensure the proper application and functioning of the TCA. The TCA provides for a conditional interim regime under which data can flow freely from the EU to the UK.  This interim period expires on 30 June 2021.

the sting Milestones

Featured Stings

Can we feed everyone without unleashing disaster? Read on

These campaigners want to give a quarter of the UK back to nature

How to build a more resilient and inclusive global system

Stopping antimicrobial resistance would cost just USD 2 per person a year

EU and China to do more in common if the global scene gets worse

Click and Download: your app is ready to help you save lives

WHO reports ‘very strong progress’ in battling DR Congo Ebola outbreak

New Eurobarometer survey shows: The majority of Europeans think the EU should propose additional measures to address air quality problems

Public Health equality in a trench

10 ways cities are tackling the global affordable housing crisis

Germany tries to save Europe from war between Ukraine and Russia

Long-term EU budget: It is not possible to do more with less, say MEPs

UN chief saddened at news of death of former US President George H.W. Bush

End discrimination against women and children affected by leprosy

Drought in southern Africa: EU releases over €22 million in humanitarian aid

These tech start-ups are changing what it means to farm

Attack on Saudi facilities risks dragging Yemen into ‘regional conflagration’: UN Envoy

Celebrating the Customs Union: the world’s largest trading bloc turns 50

How to outsmart bias when you’re recruiting

Primary Healthcare vs Specialization Careers, how to promote PHC to the Young Health Workforce?

Haitian Foreign Minister calls for development reboot to close ‘striking gap’ between promises and action on ending poverty

This is how drones and other ‘tradetech’ are transforming international trade

European Democracy Action Plan: making EU democracies stronger

Why we need a blockchain bill of rights

Prospect of a nuclear war ‘higher than it has been in generations’, warns UN

Antitrust: Commission imposes binding obligations on Gazprom to enable free flow of gas at competitive prices in Central and Eastern European gas markets

How 3 MENA business leaders are building resilient companies post-COVID-19

Thousands of health professionals call on world leaders to prioritize a greener future, post-pandemic

Kenya wants to run entirely on green energy by 2020

COVID vaccination campaign. What are the challenges?

Greece bailout ends but with no substantial effect on citizens’ life

1 million citizens try to create a new EU institution

What the next 20 years will mean for jobs – and how to prepare

Statement by Frans Timmermans, Executive Vice-President for the European Green Deal, on the announcement to postpone the COP26

EU and US take decisive step to end aircraft dispute

How COVID-19 is making companies act for the long term

We need tech solutions that value human interaction more than ever

Grievous violations continue against Myanmar civilians, Human Rights Council hears

The West and Russia accomplished the dismembering and the economic destruction of Ukraine

Guterres lauds UN peacekeeping, highlights need to bridge ‘critical’ gaps

How cities are failing to be inclusive – and what they can do about it

We must stop turning a blind eye to the world’s health crises

London wants to treat violent crime like a disease

Cybersecurity Act: build trust in digital technologies

MasterCard @ MWC14: Innovation in times of regulatory uncertainty

The digital revolution will transform the steel industry

‘Protracted crisis’ in Venezuela leads to ‘alarming escalation of tensions’: UN political chief

From battlefields to boardrooms: 3 steps to building high-morale teams

‘Act now with ambition and urgency’ to tackle the world’s ‘grave climate emergency’, UN chief urges UAE meeting

African cooperation on peace ‘increasingly strong’, Security Council told

European Green Deal: Commission presents actions to boost organic production

State aid: Commission approves €790 million Croatian guarantee scheme for companies with export activities affected by coronavirus outbreak

How COVID-19 might help us win the fight against climate change

Civilians suffering due to sanctions must be spared ‘collective punishment’ urges UN rights expert

5 urgent actions in the fightback against ransomware

The UN came of age with the nuclear bomb. Time for it to step up to the AI era

How can we prepare students for the Fourth Industrial Revolution? 5 lessons from innovative schools around the world

How digital identity can improve lives in a post-COVID-19 world

How we measure stakeholder capitalism will determine our recovery

Commission disburses €14.1 billion under SURE to 12 Member States

How distorted is the EU labour market by this crisis?

UN study projects $32 billion loss for UK post no-deal Brexit

One for all? Are physicians prepared to deliver care to the LGBTQIA+ community?

Trade surplus up production down in Eurozone

More Stings?

Comments

  1. I am very pleased with the Commission’s decision on data protection. I believe that this will help to strengthen and secure my personal information. In addition, this is a great opportunity for companies in the EU looking to expand their operations into the UK while still maintaining adequate data protection measures. Please visit my blog,  https://rpo.techfetch.com/

Speak your Mind Here

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s