On June 28, 2021, the European Commission gave the green light for continued transfers of personal data to the United Kingdom by adopting an adequacy decision to the GDPR. At the same time, it also adopted an adequacy decision to the Police-Justice Directive.
The transfer of personal data outside the European Economic Area (EEA) is subject to the existence of an adequacy decision or to the establishment of appropriate safeguards between the exporter and the importer of the data so that data subjects benefit from a level of protection equivalent to that offered by the General Data Protection Regulation (GDPR).
With BREXIT, and in the absence of an adequacy decision, data exporters would thus have had to put in place – as of July 1, 2021 – binding corporate rules or standard contractual clauses in accordance with Article 46 of the GDPR to continue transferring personal data to the UK.
The adequacy decision granted on June 28 allows data controllers to transfer their data to the UK without the need for additional safeguards, in accordance with Article 45(3) of the GDPR, as the Commission thereby recognizes that the UK provides an adequate level of protection for personal data.
It should be noted, however, that the decision on the adequacy of the RGPD is accompanied by safeguards. For the first time, the decision contains a review clause: the decision will automatically expire four years after its entry into force. It can only be renewed if the UK continues to ensure an adequate level of data protection.
Finally, transfers for the purposes of UK immigration control are excluded from the scope of the GDPR adequacy decision. This reflects a May 26, 2021, UK court ruling on the validity and interpretation of certain restrictions on data protection rights in this area. The Commission will reassess the need for this exclusion once the situation in UK law is remedied.
