On 13 April 2021, the European Data Protection Board (EDPB) adopted two opinions on the European Commission’s (EC) two draft decisions relating to the transfers of personal data from the EU to the UK.

The development is welcomed, as the UK takes one step closer to obtaining an adequacy decision which will allow for EU businesses to transfer personal data from the EU to the UK without the need for additional safeguards in place.

The EDPB largely supports the grant of a UK adequacy decision, however, the opinion advises that such decision be limited in time and that legal data protection developments in the UK be closely monitored following adoption.

The EC’s draft decisions

The EC released two draft decisions on the UK’s adequacy earlier this year. One considers the UK’s data protection framework and the level of access that the UK Government has to personal data for law enforcement and national security purposes. The other relates to the Law Enforcement Directive (LED), which assesses the UK’s standards regarding police and judicial cooperation in criminal matters, amongst other things. The EDPB opinions relate to these respectively.

What did the EDPB opinions say?

The opinions generally support the UK being granted an adequacy decision. Considering that the UK data protection framework replicates and incorporates the EU GDPR by reference into English law via the Data Protection Act 2018 (DPA), it is unsurprising that the EDPB has found ‘strong alignment’ on key areas between the EU and UK data protection regimes. However, the EDPB recognises that this could be undermined as the UK legal system on data protection evolves, especially considering that the UK Government has indicated its intention to develop separate and independent policies which may diverge from EU data protection law. The EDPB invites the EC to closely monitor the legal developments in the UK from entry into force of its adequacy decision, should one be granted.

Further concerns

The EDPB also raises other concerns that it invited the EC to further assess/monitor. One of these concerns surrounds the DPA’s ‘immigration exception’ which essentially allows for controllers that are involved with immigration-related activities to bypass certain obligations under the UK data protection laws where certain conditions are met. The EDPB has taken the view that such exception is too broad, and that the EC provide further information on this in the adequacy decision, particularly in relation to the necessity and proportionality of the exception.

The EDPB also raises concern over onward transfers that might undermine the level of protection of personal data transferred from the EEA. For example, such protection could be undermined by future adequacy decisions adopted by the UK for countries that the EC does not view as adequate and therefore onward transfers to such countries would mean that ‘essentially equivalent’ level of protection of personal data transferred from the EEA is not maintained.

What happens next?

The EC will seek approval from the representatives from each EU Member State and once completed, the EC will adopt its final decision. Until then, the EU–UK Trade and Cooperation Agreement continues to allow for personal data to flow freely from the EU to the UK until an adequacy decision finding is announced, or (if earlier) 1 May 2021 with possible extension to 1 July 2021.

Based on the draft decisions and opinions, it seems likely that an adequacy decision will be granted. If this is the case, the adequacy decision will be valid for a period of four years and it is likely the EC will closely monitor developments in UK law to assess whether the UK’s data protection laws continue to be adequate, following grant.

Developments to date and key dates that are approaching:

• 5 February 2021: The LIBE Committee of the European Parliament issued its non-binding opinion, concluding that the UK should not be granted an adequacy decision for several reasons, including perceived concerns around national security.
• 19 February 2021: the EC released its draft adequacy decisions largely suggesting the UK will be granted an adequacy decision.
• 13 April 2021: EDPB adopts its two opinions on the EC’s two draft decisions, largely in support of the UK adequacy decision.
• 1 May 2021/ (1 July 2021): under the trade agreement, the ‘bridging mechanism’ allowing the flow of personal data from the EU to UK ends, however could be extended to 1 July 2021.