The UK’s resolve to adopt an approach more focused on innovation means future adequacy decisions can’t be taken for granted
The decision is valid for four years: On Monday, the European Commission adopted the two adequacy decisions under the GDPR and under the Law Enforcement Directive, which ensure that personal data can continue to flow freely between the EU and the UK. The decisions will be valid for four years, after which they will expire automatically. The EC could renew them after that period, providing that there is still sufficient alignment between the EU and UK legal frameworks, although it would have to start a new adoption process.
An outcome that was on the cards: The adequacy decisions were widely expected due to the strong current overlap of the data protection frameworks between the two jurisdictions. Since the UK only recently left the EU and transposed the GDPR into national law, the two regimes are currently almost identical. The provisions in the trade agreement struck by the EU and the UK in 2020 also suggested that an adequacy decision would be coming. The deal set out a six-months transition period during which transfers of personal data would continue as before until an adequacy decision was granted, and also includes clauses for continuity of data flows to facilitate digital trade (e.g. no restrictions on the movement of data to either side, and no data localisation requirements). Denying the adequacy decisions to the UK would have created obstacles to the application of these conditions.
Future alignment is less certain: There are signs that the UK could seek to depart from the GDPR. In its recent response to the Data Strategy consultation, the UK Government noted it will seek “an outcomes-based approach” to regulation in order to foster innovation and remove the “disproportionate burden” on SMEs. This intention was repeated in the statement following the adequacy decision, where the Government stressed that the government plans to promote the free flow of personal data “globally and across borders”, including through new trade deals and agreements with some of the fastest growing economies. These decisions will be based on maximising innovation. Hardly a reassurance for prioritising data protection standards.
Source: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_3183
