International Data Transfers : the UK is Officially an Adequate Third Country

As expected, the Commission has adopted two adequacy decisions for transferring personal data freely to the United Kingdom – one under the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive.

These adequacy decisions also facilitate the correct implementation of the EU-UK Trade and Cooperation Agreement, which foresees the exchange of personal information, for example for cooperation on judicial matters.

It is to be noted that for the first time, these adequacy decisions include a ‘sunset clause’, which limits the duration of adequacy to four years, after which, a new assessment will be carried out.

As a result, it is no longer necessary for organisations to implement additional protection measures such as the Standard Contractual Clauses or the Binding Corporate Rules to transfer personal data to the UK.

 

What does the adoption of  an adequacy decision mean in practice ?

The adoption of an adequacy decision for a specific country means that, for the EU Commision, this specific country provides an adequate level of data protection (i.e. the legal framework is essentially equivalent to the one in the EU). 

In practice, it means that organisations subject to the GDPR can share personal data with another organisation located in this third country under the same condition as with an organisation  subject to the GDPR.

Concretely, it is not necessary for these organisations to implement additional protection measures such as the Standard Contractual Clauses or the Binding Corporate Rules to transfer personal data to the UK. They must only implement the same measures as if they shared data with a local oraganisation. (e.g. if it is a processor, a controller to processor clause compliant with article 28 GDPR would be necessary)

 

2. Key findings of the European Commission to adopt the adequacy decisions

The Commision found that the UK provided an equivalent level of protection mainly for the following reasons:

  • The UK’s data protection system continues to be based on the same rules that were applicable when the UK was a Member State of the EU.

 

  • Transfers for the purposes of UK immigration control are nonetheless excluded from the scope of the adequacy decision adopted under the GDPR due to a recent judgment of the Court of Appeal of England & Wales on the validity and interpretation of certain restrictions of data protection rights in this area. The Commission told, however, that it will reassess the need for this exclusion once the situation has been remedied under UK law.
3. Effect of the Sunset Clause
  • The adequacy decisions include a ‘sunset clause’, which limits the duration thereof to four years. After that period, the adequacy findings might be renewed only if the UK continues to ensure an adequate level of data protection.
  • Besides, the Commission will monitor the legal situation in the UK and could intervene at any point before the end of this 4 year period, if the UK deviates from the level of protection currently in place.
  • If the Commission decided to renew the adequacy finding, the adoption process would start again.

 

For a full reading of the adequacy decision, click here

For any question, do not hesitate to contact Arnaud Blanc

International Data Transfers : the UK is Officially an Adequate Third Country

This post is also available in fr_FR.