Apr 16, 2021 12:00:00 AM | Brexit No Brexit for personal data flows? & how to prepare to prevent gaps

On 14 April 2021 the European Data Protection Board (EDPB) adopted two Opinions on the draft UK adequacy decisions.

It is not a done deal, but the report by the EU wide umbrella organisation for privacy protection seems to be one more significant hurdle cleared for EU-UK data flows.

There are two opinions since there are two draft adequacy decisions, one dealing with law enforcement and national security and the second dealing with more general data protection and data transfer matters.

What’s “adequacy”?
Adequacy decisions are the process by which the European Union decides whether countries outside the bloc offer an adequate level of protection for the personal data of individuals in the EU, therefore granting seamless data flows between the EU and so-called “third countries”, like the UK post-Brexit.

What did the EDPB think of the adequacy decisions?
Whilst the Opinions have not yet been published, the EDPB has confirmed in a press release that it has identified “many aspects [of the UK data protection framework] to be essentially equivalent” to the EU data protection framework.

The EDPB Chair, Andrea Jelinek, acknowledged that “laws can evolve” however and therefore that the EDPB “welcomes the [European] Commission’s decision to limit the granted adequacy in time” to ensure continued alignment with the EU data protection framework in the future.

If adopted it is proposed that the two adequacy decisions will run for an initial period of four years. This timescale is quite significant – the 2019 Adequacy Decision for Japan is subject to review every two years and the US-EU Privacy Shield scheme was subject to annual review.

So, all is well on the Northern front?
This is a major step in the right direction, but it is not an unqualified blessing. The EDPB highlights a number of areas requiring further assessment and monitoring including:

1. The UK exception for immigration data
2. Onward transfers, particularly for adequacy decisions by the UK itself

And regarding access by public authorities for national security purposes to personal data transferred to the UK:

1. Bulk interceptions
2. Use of automated processing tools;
3. Safeguards provided under UK law when it comes to overseas disclosure, in particular in light of the application of national security exemptions (such as with the USA)

Will it be in time? How to prepare?
The draft UK adequacy decisions will now be assessed by representatives of the EU Member States. Although it is not officially involved in the procedure, our chosen representatives in the European Parliament will no doubt be expressing their views. The Commission is then able to adopt the draft UK adequacy decisions – hopefully prior to the end of the bridging period at the end of June 2021. 

To prevent a gap in data transfer, it might be beneficial to include SCC in as many contracts as possible, with a clause stipulating they are in effect when there is no adequacy decision in place.