Byte-sized Brexit: The future of UK-EU data adequacy

In June 2021, the EU approved adequacy decisions from the EU GPDR and the Law Enforcement Directive (“LED”) which are expected to last for four years, until June 2025. These decisions are fundamental to the UK as they ensure that data can flow between the UK and countries within the EU, just as they did prior to Brexit.

What does adequacy mean?
The term ‘adequacy’ is used by the EU to describe countries, territories, sectors or organisations that it deems to have “essentially equivalent” standards of data protection to the EU.

The EU adequacy decisions apply to all UK businesses or organisations that receive personal data from the EU and/or the European Economic Area (“EEA”). As the UK is deemed adequate, UK businesses do not need to take any action at this time, and data received from the EU can continue to flow as it did prior to Brexit, unless it is data which is included in the Data Protection Act 2018 (“DPA”) immigration exception. If your business has an office, branch or other established presence in the EEA, you need to comply with both EU and UK data protection regulations.

Does GDPR still apply?
Post Brexit, the UK adopted the General Data Protection Regulation, creating UK GDPR. Organisations operating within the UK need to comply with the UK GDPR and the DPA. The Information Commissioner’s Office (“ICO”) is the sole supervisory body for the UK’s data protection legislation. The ICO is not the regulator for European-specific activities, however it does work closely with the European supervisory authorities.

What if we lose adequacy?
Although UK GPDR and the Data Protection Act 2018 are governed by the UK, the EU Commission continues to monitor developments in the UK to ensure that the standard of data protection remains “essentially equivalent”. If we no longer retain EU GDPR adequacy, the “Frozen GDPR” would come into effect and may require businesses to identify any personal data about individuals located outside the UK collection prior to the end of 2020.

The House of Lords European Affairs Committee (“EAC”) recently published a letter to the Secretary of State for Science, Innovation and Technology, Peter Kyle. In this letter, they highlight their concerns about the UK potentially losing its GDPR adequacy following their inquiry into UK-EU data adequacy. The inquiry found that if the UK loses its adequacy status, there could be an abundance of negative outcomes for UK businesses. These vary from significant costs and administrative burdens to increased international trade barriers to potentially negative impacts on the Good Friday Agreement and the Windsor Framework Agreement. The Secretary of State is expected to respond to the letter within a month.

The EAC considers that the government should engage with the European Commission to ensure the adequacy status is renewed and seek to secure future adequacy renewal decisions which do not expire after a fixed period.

The EAC also recommends that the government:
• engages with the Commission in order to explain and provide reassurance with respect to any planned data protection reforms
• approaches the renewal of the UK’s adequacy status as part of its wider ‘reset’ of relations with the EU
• maintains high data protection and privacy standards which are in line with other international standards
• in preparing the Digital Information and Smart Data Bill, should take into account the amendments to the previous Data Protection and Digital Information Bill which were adopted before it fell at dissolution of Parliament.

If you require any Data Protection advice, contact our Corporate, Commercial & Regulatory team.