Few days ahead of the expiration of the “EU-UK Trade and Cooperation Agreement (TCA)”’s interim period on June 30, 2021 (the so-called “bridge”), today the European Commission has adopted two adequacy decisions under the GDPR and the Law Enforcement Directive facilitating data transfers to the United Kingdom.
In its recent decisions, the EU Commission highlights that the UK’s data protection system continues to be based on the same rules that were applicable when the United Kingdom was a Member State of the European Union.
With respect to access to personal data by public authorities in the United Kingdom, notably surveillance and security services – an issue that has been under the spotlights in the context of the ECJ’s Schrems II judgement and the invalidation of the US Privacy Shield – the UK system provides for strong safeguards, according to the EU Commission (e. g. prior authorisation systems by independent judicial bodies, the application of necessity and proportionality principles, the existences of international treaties, ….).
Finally, based on a so-called ‘sunset clause’, the adequacy decisions will automatically expire on June 27, 2025. After that period, the adequacy findings might be renewed provided that the United Kingdom continues to ensure an adequate level of data protection, which will be monitored by the EU Commission.
Access the decisions here.
Contact us: firstname.lastname@example.org