The European Data Protection Board (EDPB) adopted two opinions on the European Commission’s draft UK adequacy decision at its 48th plenary session and early indications are that their stance is favourable.
It will now be for the European Commission to seek approval from representatives from each EU Member State, after which a final decision will be made. If the UK is granted the adequacy decision, it would be valid for four years and renewable only if the UK’s data protection framework continues to be adequate. For the time being the UK continues to enjoy unrestricted transfers until 1 May 2021 and unless there are objections, will automatically be extended to 1 July 2021.
The Opinions’ details
The EDPB pointed out areas of strong alignment between the EU and UK’s data protection frameworks on provisions such as lawful grounds for fair processing for legitimate purposes, purpose limitation, data proportionality and quality, data retention, security and confidentiality, transparency, special categories of data and on automated decision making and profiling. According to the EDPB, for a country to get adequate determination, the third country’s legislation must be aligned with the essence and spirit of the fundamental principles enshrined in the GDPR. Accordingly, it concluded in its opinion that there is a ‘strong alignment between the EU and UK’s frameworks.
The EDPB chair Andrea Jelinek, addressing the strong alignment between the EU and the UK and how the UK has mirrored most of the EU’s GDPR, advised the alignment should be maintained even though laws can evolve.
The EDPB emphasised that the European Commission should assess and closely monitor several items in its decision, including the UK immigration exemption and its implications for data subjects rights, the restrictions and the imposition of limitations on onward transfers to EEA personal data to the UK based on future adequacy decisions adopted by the UK, international agreements signed between the UK and third countries or derogations.
Further clarifications and monitoring are needed according to the EDPB regarding public authority access to personal data transferred to the UK for national security purposes, especially concerning bulk interceptions, supervision of automated processing tools and protections given under UK law regarding overseas disclosure. The EDPB applauds the creation of the Investigatory Powers Tribunal (IPT) to resolve the challenges of redress in the area of national security, as well as the inclusion of Judicial Commissioners in the Investigatory Powers Act (IPA) 2016 to ensure greater oversight.
This development is welcomed by global DPOs and privacy practitioners wrestling with a multitude of data transfers requirements. HewardMills continues to monitor and update its clients on this strategically important area.
