As a result of Brexit, under the General Data Protection Regulation (GDPR), UK became a “third” country. This means organisations need to put in place a safeguard to transfer personal data to a third country, typically Standard Contractual Clauses, known as SCCs.
On 28 June 2021, the European Commission (EC) adopted two adequacy decisions for the UK: one under the GDPR and the other for the Law Enforcement Directive. The EC states that personal data can now flow freely from the EU to the UK where it benefits from an essentially equivalent level of protection to that guaranteed under EU law. The two adequacy decisions took effect on 28 June 2021.
The EC’s reasoning for adopting the UK’s adequacy decision is that the UK’s data protection system is still based on the same rules that applied when the UK was a member of the EU and the UK has fully incorporated the GDPR and Directive’s principles, rights and obligations into its post-Brexit legal system.
Despite this explanation, the EC declared that it continues to monitor the legal situation in the UK and it may act at any time if the UK departs from the current level of protection that is in place.
The adequacy decision however does not cover UK immigration control due to a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area. The EC further mentioned that once the situation has been remedied under UK law, it will reassess the need for this exclusion.
What does this mean for businesses/organisations transferring personal data to the UK?
As a result of the UK gaining adequacy status, businesses can now freely transfer personal data to the UK without having to provide appropriate safeguards. The EC has established that the UK’s data protection laws are adequate enough to guarantee that personal data can be safely transferred from the EU to the UK (and EEA).
UK businesses do not need to make any modifications to data protection practices or standards. Individuals, on the other hand, should now feel confident that their personal data will be processed fairly, transparently and in a lawful manner.
By Dorcas Abass