The Commission has launched the process for the adoption of two adequacy decisions for transfers of personal data to the UK, one under the General Data Protection Regulation (2016/679/EU) (GDPR) and the other for the Law Enforcement Directive (2016/680/EU) (LED). The publication of the draft decisions is the beginning of a process towards their adoption. This involves obtaining an opinion from the European Data Protection Board (EDPB) and the green light from a committee composed of representatives of EU Member States. Once this procedure has been completed, the Commission can proceed to adopt the two adequacy decisions.

The Commission says that is has carefully assessed the UK’s law and practice on personal data protection, including the rules on access to data by public authorities and concluded that the UK ensures an essentially equivalent level of protection to that guaranteed under the GDPR and the LED.

The Commission says that compared to other non-EU countries where convergence is developed through the adequacy process between often divergent systems, EU law has shaped the UK’s data protection regime for decades. At the same time, it is essential that the adequacy findings are futureproof now that the UK is no longer bound by EU privacy rules. Therefore, once these draft decisions are adopted, they will be valid for a first period of four years, after which they can be renewed, but only if the level of protection in the UK continues to be adequate.

After taking the opinion of the European Data Protection Board into account, the Commission will request the green light from Member States’ representatives. Following that, the Commission an adopt the final adequacy decisions for the UK. To read the Commission’s press release in full and to access the draft decisions, click here.