Adequacy decision approved: How will this affect your business?

This week the EU Commission announced that it has approved the adequacy decisions for the UK.

This means the EU currently considers the UK’s level of data protection to be aligned with the EU and offers a high level of safeguarding. There are two adequacy decisions related to the transfer of personal data to the UK, one related to the GDPR and one to the Law Enforcement Directive.

This approval by the EU will be welcome news to UK businesses. The adequacy decision is important in a post Brexit world to ensure personal data can travel freely between the EU and the UK, with the required protection in place.

The decision was reached on 28 June 2021. Since Brexit, data has continued to flow freely between the EU and UK under the interim measures, or ‘bridging mechanism.’ These measures were  set to expire on 30 June 2021, so this decision has been granted just in time.

Why is the outcome of the adequacy decision good news for UK businesses?

UK businesses, for the time being, will not have to make any changes to how they handle and process data from those within the EU. The adequacy decisions are granted for 4 years, at which point they will expire, and the situation will be re-evaluated. This is called the ‘sunset clause’. No other country granted adequacy decisions by the EU currently has this sunset clause in place.

Adequacy and UK trade agreements with third countries

Despite the adequacy lasting for 4 years the EU have the authority to monitor the situation and intervene at any point if they feel the UK’s data protection levels are reduced. We know the UK will be looking to move forward on trade agreements with nations who are not within the EU’s list of adequate territories, for example Australia and the United States. It will be interesting to note what position the EU takes on this, as the sharing of personal data between such nations is likely to form part of any trade deal. The UK’s relationship with such third party countries was one key point of concern expressed within the European Parliament in the lead up to the adequacy decision being granted.

The future of UK data protection

In the government’s official press release regarding the adequacy decision, Oliver Dowden, Secretary of State for Digital has been quoted as stating: “We will now focus on unlocking the power of data to drive innovation and boost the economy while making sure we protect people’s safety and privacy.” This indicates that the UK are still keen to further developments and promote innovation, particularly to improve publics services and technology businesses.

The Government also remain eager to reduce the onus on businesses and organisations using data to combat important global issues such as climate change and preventing disease.

What happens in the event that the adequacy decision is withdrawn?

The Government will have to be mindful when promoting innovation and reducing the burden on businesses that the EU can revoke the adequacy decision at any time if they have concerns. If the adequacy decision is withdrawn and not reinstated by the EU, the cost to UK businesses could be huge. The UK would be considered a ‘third country’ and any organisation processing personal data of those based within the EU would have further compliance requirements placed on them, costing both time and money.

What should you do now?

You do not currently need to make any changes to the way you process and handle data from those individuals based in the EU. Businesses should be mindful that the UK’s situation will be monitored by the EU and therefore changes may be required in the future. As such, it is advisable to regularly review your contingency plans.

Please contact a member of our team is you require any assistance with this.

This content is correct at time of publication