Adequacy decision of the EU Commission: UK is a safe third country
Just in time for the expiry of the transitional period, the EU Commission issued an adequacy decision on June 28, 2021, pursuant to Sec. Art. 45 EU GDPR issued for the United Kingdom (UK). The UK will be recognized as a safe third country, so that personal data can be transferred unhindered from the EU to the UK even after Brexit.
Procedure
In the first attempt, the EU Parliament still rejected the approval of the adequacy decision with the United Kingdom by a narrow majority on 20.05.2021. As a result, the transition period would have formally expired on June 30, 2021. As the British are no longer a member of the EU or the European Economic Area (EEA) as of 01.01.2021, the UK constitutes a third country and Art. 44 et seq. EU-DSGVO have to be observed. As a consequence, the transfer of data to the United Kingdom as of 01.07.2021 would in principle only have been possible under the narrow conditions of Art. 46 EU GDPR. Accordingly, the transfer of personal data to a third country without an adequacy decision is only permitted if appropriate safeguards are in place, such as the application of the standard contractual clauses.
Now, just in time, the EU Commission was able to declare the United Kingdom as a third country with an adequate level of data protection. A new feature of the adequacy resolution is that for the first time it contains a so-called sunset clause, which limits the period of validity of the resolution to four years.
Criticisms of the European Data Protection Committee (EDSA)
In its opinion, the EDSA informed the Commission that it did not oppose the release of a data transfer to the UK based on the adequacy finding, but at the same time criticized the following two points:
- The transfer of data from the UK to other third countries might not ensure an adequate level of data protection for personal data and data subjects’ rights.
- Investigatory Powers Act of 2016 enables expanded surveillance powers of British intelligence agencies.
Outlook
With this decision, the EU Commission is creating a legally compliant basis for the secure exchange of data between the EU and the UK to take place as usual. Nevertheless, it remains to be seen whether the adequacy decision will stand up in the longer term as a legally compliant basis for data transfers to the United Kingdom. This is because the British security authorities also have extensive surveillance powers in the UK, which means that the ECJ could deal with the adopted resolutions in the future. Furthermore, the question arises as to how the British government will structure its data protection regulations (“UK-GDPR”) in the future.
The adequacy decision is available here.