On the 14th of April 2021, the European Data Protection Board (EDPB) adopted two opinions on the European Commission's draft adequacy decision for the transfers of personal data from the EU to the UK.
The EDPB assessed the alignment of the UK Data Protection Act to the GDPR and to the Law Enforcement Directive, and noted 'strong alignment' on key areas between the EU and UK data protection regimes such as lawful and fair processing for legitimate purposes, purpose limitation, data quality and proportionality, data retention, transparency and special categories of data, to name a few.
Andrea Jelinek, chair of the EDPB, commented that the "UK data protection framework is largely based on the EU data protection framework", that the UK has "mirrored for the most part, the GDPR and LED" and that the EDPB acknowledged many aspects to be "essentially equivalent". She also welcomed the Commission's decision to time limit the granted adequacy and the intention to closely monitor UK developments.
The EDPB, however, felt that additional areas were ripe for further assessment and/or that the areas should be closely monitored by the European Commission, particularly:
- The Immigration Exemption and its significance on restrictions on data subject rights;
- The application of restrictions to onward transfers of EEA personal data transferred to the UK and other international agreements concluded between the UK and third world countries or derogations.
The EDPB welcomed the creation of the UK's Investigatory Powers Tribunal and its ability to review access to data by UK national security agencies, the establishment of the Judicial Commissioners in the Investigatory Powers Act 2016 to ensure better oversight, and to provide individuals with opportunities to seek redress. The EDPB still raised concerns related to national security monitoring, bulk interceptions, independent oversight related to the use of automated processing tools, and safeguards under UK law related to overseas disclosure of data, especially for national security.
Notwithstanding the opinions suggesting additional assessments or the alternative of monitoring, there is nothing in the EDPB's statement about its plenary meeting and the opinions it adopted on UK adequacy that look likely to change the EC's preliminary opinion. Barring any further exceptions or new developments, it looks likely that the UK will be approved as an adequate jurisdiction for transfers of personal data from the EU.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.