European Commission launches process on personal data flows to UK

On Friday, the European Commission published its draft decisions in respect of the UK’s adequacy for transfers of data from the EU to the UK under both the GDPR and the Law Enforcement Directive.  This is the first major step on the path to the UK achieving “adequacy” with 2 further steps to be carried out before the adequacy decision is finalised – these are: to obtain a “non-binding opinion” from the European Data Protection followed by formal approval from the EU member states.

As part of the Brexit negotiations the UK and EU agreed an “interim period”, which was a period of 4 months ending on 30th April but with an option to extend until 30th June 2021.  During this interim period EU organisations can continue to send personal data to organisations in the UK without a formal adequacy decision from the EU.  If no adequacy decision has been reached before the end of the interim period then additional measures will need to be taken by EU organisations to permit them to continue sending personal to the UK.

We are already nearly half way through the initial 4 month interim period, so completion of this first step is very good news.  The UK government has issued a press release welcoming the drafts but urging the EU to “fulfil its declared commitment to complete the technical approval process quickly”.  There is no mandated timetable for the completion of the process, but we certainly hope that there is enough benefit to both sides to make this a high priority for all.