EDPB adopts opinion on draft UK adequacy decision
On April 14, 2021, the European Data Protection Board (“EDPB”) announced that it had adopted its opinion on the draft UK adequacy decision issued by the European Commission on February 19, 2021. The EDPB’s opinion is non-binding, but it will be convincing. The adequacy decision is formally adopted when approved by the EU Member States acting through the European Council. If the adequacy decision is made, the transfer of personal data from the EU to the UK can continue after the end of the post-Brexit transition period without introducing a data transfer mechanism under the EU General Data Protection Regulation (“GDPR”). like standard contractual clauses.
The EDPB stated in its press release that there are key areas for strong convergence of data protection rules in the EU and the UK. The UK transposed the GDPR into national law prior to leaving the EU, which means that the EU and the UK are coordinated for legitimate purposes, for example for lawful and fair processing. Purpose limitation; Data quality and proportionality; Data retention, security and confidentiality; Transparency; special categories of data; and automated decision making and profiling.
Andrea Jelinek, Chair of the EDPB, said: “The UK data protection framework is largely based on the EU data protection framework. Therefore, the EDPB recognizes that the UK has for the most part reflected the GDPR in its data protection framework and when analyzing its legal and practice framework, the EDPB has identified many aspects as essentially equivalent. “
However, Jelinek warned that this alignment would have to continue in the future if a UK adequacy decision is to be upheld and welcomed the ongoing monitoring of the UK data protection regime by the European Commission and suggested that an adequacy decision be reviewed within four years. The EDPB also drew attention to the way in which the UK has departed from the GDPR, for example by introducing exemptions from certain data protection rights for processing related to immigration, and stated that ongoing monitoring in relation to the transmission of EU data should take place from Great Britain to third countries.
The EDPB also stated that further clarifications and ongoing monitoring are needed regarding access by authorities for national security purposes to personal data transferred to the UK, in particular with regard to interception of bulk goods, monitoring of automated processing tools and safeguards provided by UK law in relation to overseas disclosure.
Before adopting its opinion, the European Commission reportedly advised the EDPB to moderate its critical view of the UK-provided data protection standard on the basis that the UK mirrors the EU data protection standard almost exactly and a finding that The United Kingdom was not appropriate. This would prevent other jurisdictions from adapting to the EU regime in the hope of making their own adequacy decision.
Read the EDPB opinion.