The UK’s EU Data Adequacy Status

Back in June 2021, the EU Commission adopted an adequacy decision with respect to the UK under the GDPR, meaning that personal data could continue flowing between the EU and the UK as it had done prior to Brexit (and the subsequent end of the temporary data-bridge established under the EU-UK Trade and Cooperation Agreement).

What made the June 2021 adequacy decision unusual was that it was time-limited to four years, with the intention of safeguarding against future divergence. This means that the EU Commission will review the adequacy decision by June next year.

With this in mind, the House of Lords European Affairs Committee has launched an inquiry into the UK’s data adequacy status and its implications for the UK-EU relationship.

What aspects of data adequacy is the House of Lords looking at?

The inquiry seeks written evidence from interested parties with expertise in or experience of the topics under consideration. It is important to note that there are in fact two adequacy decisions that are up for renewal - one under the GDPR, the other under the Law Enforcement Directive. Our focus in this newsletter, however, is the GDPR (and UK GDPR). The call for evidence asks the following key questions (with sub-questions for each):

• What is your assessment of the existing adequacy arrangement underpinning data flows between the UK and the EU? This section looks at the value of the UK’s adequacy status to UK organisations, how well the GDPR works in practice, and how effectively the ICO is performing.
• What are the possible challenges to the UK-EU data adequacy regime? This part considers points including factors that could influence the EU Commission’s decision to renew and the possible impact of proposed UK rules on automated decision-making and the use of AI.
• What implications, if any, would a no or disrupted UK-EU data adequacy scenario have? This question considers divergence between the UK and EU, for example, in the form of the Data Protection and Digital Information Bill; the risk of the EU Commission withdrawing its decision; and the impact such withdrawal would have on organisations.
• What can be learned from other countries’ experience with the adequacy system and engagement with the EU Commission’s process? The EU Commission has recently reviewed the adequacy of 11 countries and territories. This point asks what lessons can be learned from these reviews and what examples of best practice can be identified. Another significant point under this heading is the possible implications of the UK granting its own adequacy decisions to countries not currently covered by EU adequacy decisions.

Submitting Responses to the Inquiry

The call for evidence is open until 3 May 2024 and can be accessed here (external link). Not all questions in the call for evidence will be relevant to all parties, and particularly not to SMEs, but there is no obligation to answer all questions, and this is a valuable opportunity for those transferring personal data across borders to have their say on this important issue.