Last minute EU decision allows data to flow freely

Once again negotiations between the EU and the UK have run down to the wire. The transition period for data transfers between the bloc and the UK was due to end today, 30 June. Just in the nick of time, the EU has formally adopted an ‘adequacy’ decision which will allow data to continue to flow freely. This means that business in the UK and EEA alike can breathe a sigh of relief.

What is an adequacy decision?

The transfer of personal data outside the EEA, which is usually a ‘restricted transfer’, is permitted where the EU has found that country’s data protection and privacy regime to be ‘adequate’ and in line with the strict controls of the EU General Data Protection Regulation 2016/679.

A transition arrangement has been in place since Brexit, which treated the UK as if it were still a member of the EU for data protection purposes, but this was set to end. If the adequacy decision had not been approved, the UK would have been classed as a third country for data protection purposes and the transfer of personal data from the EU would be permitted only subject to additional arrangements.

Is the decision unexpected?

The UK GDPR is almost identical to the EU equivalent, so in many ways the decision is not surprising. Although the EU published a draft finding of adequacy in February, this required final authorisation and, with the deadline of the 30 June as the end of the transitional arrangements approaching, there was no room for complacency.

Formal adoption of the adequacy decision confirms that personal data is permitted to flow freely between the UK and the EEA. This means that UK based organisations can continue to receive EEA personal data on the same basis, without additional restrictions.

Why does it matter?

The use of personal data is essential to the UK economy and the everyday trade of goods and services. That this can now continue to happen without additional barriers may be a positive indication about the UK’s trading relationship with the EU.

It is interesting to note that transfers of personal data for the purpose of UK immigration control are excluded from the decision.

What does it mean for my business?

Although the decision means that UK business may transfer data to and from the EU without carrying out additional due diligence, the EU data protection regime must still be considered. The finding of adequacy will expire in 2025 and can be revoked at any time without notice. It is the first time an adequacy decision has a fixed expiry date, which indicates the EU’s reservations about the future direction of UK data privacy.

It is expected that gaps between the UK and EU’s laws will widen over time, and as the landscape of data protection and privacy in the UK evolves, this may impact the transfer of data with the EU. One area which is likely to continue to cause concern for the EU is the onward transfer of data out of the UK to jurisdictions such as the USA.

Further, British business without an EU establishment which provide goods or services to individuals in the EU will still need to take steps comply with EU data protection laws. This means that many will need to ensure they comply with both UK and EU legislation.