GDPR: adequacy decision allows transfer of personal data to the UK
On 28 June 2021, the European Commission adopted an adequacy decision authorising the transfer of personal data to the UK.
On 28 June 2021, the European Commission adopted an adequacy decision authorising the transfer of personal data to the UK.
Context
Under the GDPR, a transfer of data to a third country is only permitted if this country offers an « adequate level of protection ». This is particularly relevant for companies that store information on servers in such a « third country ».
Since the Brexit, the UK is considered to be a « third country » in the GDPR framework, but the Trade agreement concluded at the end of December 2020 provided for a transition phase until 30 June at the latest.
The GDPR provides for several options to demonstrate the adequate level of protection of a third country, including the adoption of an "adequacy decision" by the European Commission.
On 28 June 2021, such a decision was adopted for the transfer of data to the UK.
The adequacy decision
In summary, this adequacy decision :
ensures that the UK provides an adequate level of protection for transferred data, in line with the requirements of the GDPR. However, the Commission will continue to monitor the development of the legal framework in the UK to ensure that an adequate level of protection is maintained. If necessary, the Commission could suspend, repeal or amend the Decision;
does not allow for the transfer of UK immigration control data;
will expire on 27 June 2025, unless extended by the European Commission.
What to remember?
EU-based companies may continue to transfer personal data to the UK in the same way as they would transfer it to another Member State, subject to the requirements of the GDPR.
The European Commission's adequacy decision ensures that the UK offers an equivalent level of protection to that applicable in the EU for the processing of personal data.
Source :Commission implementing decision of 28.6.2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom, ec.europa.eu