Article written by Haim Ravia, Dotan Hammer and Adi Shoval
The EU Commission published the draft adequacy decision for the United Kingdom, acknowledging that the UK is a jurisdiction with adequate protections for personal data. Once adopted by the EU Commission, the decision would allow the seamless flow of personal data from the EU to the United Kingdom.
The European General Data Protection Regulation (“GDPR”) establishes several mechanisms for international transfer of data from the EU to non-EU countries. Under the GDPR, the easiest and safest mechanism for the international data transfers is the transfer of data to countries recognized by the EU Commission as having adequate protection of personal data with an essentially equivalent level to the level of protection in the EU.
Ever since the UK withdrew from the EU on December 31, 2020, data flows from the EU to the UK were governed by an interim arrangement under the trade cooperation agreement signed by the EU and UK governments. The arrangement allowed the continued flow of data from the EU to the UK until the earlier of six months or an EU Commission adequacy decision is issued for the UK.
After reviewing the UK’s legal framework, the EU Commission released two draft adequacy decisions for the UK, under both the GDPR and the Law Enforcement Directive which addresses the collection and transfer of data between law enforcement authorities. The draft decisions are subject to the non-binding, but authoritative opinion of the European Data Protection Board and the approval of the member states representatives. Once formally adopted, the UK adequacy decision will be valid for 4 years.
CLICK HERE to read the EU Commission’s press release on the UK adequacy decisions.
