Following its official departure from the EU on 1 January 2021, the UK is now classified as a ‘third country’ for data protection purposes. This means that the European Commission has until 30 June 2021 (when the current grace period ends) to make its GDPR adequacy decision, where it will determine whether the UK has an adequate level of data protection.
If the Commission decides that an external country’s data protection standards are adequate, then personal data can be sent from an EEA state to a third country without any further safeguard being necessary. If the outcome of the adequacy decision is positive for the UK, this will mean that UK businesses handling data belonging to individuals within the EU will be able to operate as before, without the need to take any further data protection measures.
On 19 February 2021, the Commission published a draft adequacy decision concluding that the UK ensures a similar level of protection to the EU for personal data as set out in:
Whilst this draft decision appears to be a positive sign for UK business, this is only one step in a lengthy process before the UK can be approved as an ‘adequate’ third country. Before then, three crucial stages must be passed:
The publication of the draft adequacy decision seems to be good news for UK business, however the decision is by no means final. Moreover, even if the decision is formally adopted, it may not be a straight road ahead for UK business; there is the potential that the decision could be met with legal challenges in UK courts and there will also be a four-yearly review of the position by the European Commission.
It is highly advisable for UK companies to continue to carefully monitor updates on the UK GDPR adequacy decision, and to exercise caution when transferring data.
If you run a business and have any questions or queries concerning the GDPR adequacy decision, our team of experienced Corporate & Commercial solicitors are more than happy to advise. Get in touch with our team at firstname.lastname@example.org for more information.