Contact us today - 0330 094 9338
Contact us today - 0330 094 9338
The European Union (EU) has formally recognised the UK’s data protection standards after more than a year of constructive talks. Personal data can now continue to flow between Europe and the UK. This means that UK businesses and organisations can continue to receive personal data from the EU, without having to put additional arrangements in place with European counterparts.
On 28 June 2021, the European Commission finally announced its long-awaited decision that UK data protection standards are “adequate”. This has paved the way for the continued transfer of EU citizens’ personal data (governed by the EU GDPR rules) to the UK. This free flow of personal data is designed to support trade, innovation and investment, and to assist with law enforcement agencies tackling crime. It is also hoped that it will facilitate health and scientific research.
Without this decision, British businesses (from logistics to automotives industries) would have been forced to set up more costly, bureaucratic alternatives for the sharing of data.
What does “Adequacy” mean?
The GDPR primarily applies to controllers and processors in the European Economic Area (EEA). Now that the UK has left the EU, it has become a “third country”, which falls outside of the GDPR zone of the EEA. The GDPR restricts transfer of personal data to third countries, unless personal data is protected in another way, or an exception applies. The European Commission has the power to determine whether a third country has an adequate level of data protection. The effect of an adequacy decision is that personal data can be sent from an EEA state to a third country without any further safeguard being necessary.
The UK operates a fully independent data policy, and had already recognised the EU member states as “adequate” as part of its commitment to establish a smooth transition for the UK’s departure from the EU.
The way ahead
The EU has warned that the decision could be revoked immediately if it sees a weakening in UK standards, in other words, that the UK was unable to offer EU citizens sufficient protection over the handling of their personal data. There will be an ongoing review of the UK’s adequacy, which means that if the UK goes too far in liberalising its regime, in particular with regard to the international transfer of data, the European Commission has reserved the right to change its mind.
The UK government is currently busy promoting the free flow of data globally, including through ambitious new trade details and new data adequacy agreements with some of the fastest growing economies, whilst committing to ensuring that people’s data continues to be protected to a high standard.