Adequacy decision of the EU Commission: UK is a safe third country
Shortly before the end of the transitional period, the EU Commission issued an adequacy decision on June 28, 2021, in accordance with Sec. Art. 45 EU GDPR issued for the United Kingdom (UK). The UK is thus recognized as a safe third country, so that personal data can be transferred unhindered from the EU to the UK even after Brexit.
Procedure
In the first attempt, the EU Parliament on 20.05.2021 still rejected the approval of the adequacy decision with the United Kingdom by a narrow majority. As a result, the transition period would have formally expired on June 30, 2021. As the British are no longer a member of the EU or the European Economic Area (EEA) as of 01.01.2021, the UK is a third country and therefore Art. 44 et seq. EU-DSGVO have to be observed. As a consequence, the transfer of data to the United Kingdom as of 01.07.2021 would in principle only have been possible under the narrow conditions of Art. 46 EU GDPR. Accordingly, the transfer of personal data to a third country without an adequacy decision is only permitted if appropriate safeguards are in place, e.g., the transfer of personal data to a third country without an adequacy decision. when applying the standard contractual clauses, permissible.
Now, just in time, the EU Commission was able to declare the United Kingdom as a third country with an adequate level of data protection. A new feature of the adequacy decision is that it contains a sunset clause for the first time, which limits the validity of the decision to four years.
Criticisms of the European Data Protection Committee (EDSA)
In its opinion, the EDSA informed the Commission that it did not oppose the release of a data transfer to the UK on the basis of the adequacy decision, but at the same time criticized the following two points:
- The transfer of data from the UK to other third countries might not ensure an adequate level of data protection for personal data and data subjects’ rights.
- The Investigatory Powers Act of 2016 enables expanded surveillance powers for British intelligence agencies.
Outlook
With this decision, the EU Commission is creating a legally compliant basis for the secure exchange of data between the EU and the UK to take place as usual. Nevertheless, it remains to be seen whether the adequacy decision will stand up in the longer term as a legally compliant basis for data transfers to the United Kingdom. This is because the British security authorities also have extensive surveillance powers in the UK. Thus, the ECJ could deal with the adopted decisions in the future. The question also arises as to how the British government will structure its data protection regulations (“UK-GDPR”) in the future.
The adequacy decision is available here.