EDPB adopts opinion on draft UK adequacy decision
On April 14, 2021, the European Data Protection Board (“EDPB”) announced that it had adopted its opinion on the draft UK adequacy decision issued by the European Commission on February 19, 2021. The EDPB’s opinion is non-binding, but it will be convincing. The adequacy decision is formally adopted when approved by the EU Member States acting through the European Council. If the adequacy decision is made, the transfer of personal data from the EU to the UK can continue after the end of the post-Brexit transition period without introducing a data transfer mechanism under the EU General Data Protection Regulation (“GDPR”). like standard contractual clauses.
The EDPB stated in its press release that there are key areas for strong convergence between data protection regimes in the EU and the UK. The UK transposed the GDPR into national law prior to leaving the EU, which means that the EU and the UK are coordinated for legitimate purposes, for example for lawful and fair processing. Purpose limitation; Data quality and proportionality; Data retention, security and confidentiality; Transparency; special categories of data; and automated decision making and profiling.
Andrea Jelinek, Chair of the EDPB, said: “The UK data protection framework is largely based on the EU data protection framework. Therefore, the EDPB recognizes that the UK has for the most part reflected the GDPR in its data protection framework and in its analysis of law and practice the EDPB has identified many aspects as essentially equivalent. “
However, Jelinek warned that this alignment would have to continue in the future if a UK adequacy decision is to be upheld and welcomed the European Commission’s ongoing monitoring of the UK data protection regime and the proposed review of an adequacy decision within four years. The EDPB also drew attention to the way in which the UK has departed from the GDPR, for example by introducing exemptions from certain data protection rights for processing related to immigration, and stated that ongoing monitoring in relation to the transmission of EU data should take place from Great Britain to third countries.
The EDPB also stated that further clarifications and ongoing monitoring are needed in relation to public sector access for national security purposes to personal data transferred to the UK, in particular in relation to interception of bulk goods, monitoring more automated Processing Tools and Safeguards Disclosure Under UK Law Overseas.
Before adopting its opinion, the European Commission reportedly advised the EDPB to moderate its critical view of the UK-provided data protection standard on the basis that the UK mirrors the EU data protection standard almost exactly and a finding that The United Kingdom was not appropriate. This would prevent other jurisdictions from adapting to the EU regime in the hope of making their own adequacy decision.
Read the EDPB opinion.