We are a *knowledge business

Following its official departure from the EU on 1 January 2021, the UK is now classified as a ‘third country’ for data protection purposes. This means that the European Commission has until 30 June 2021 (when the current grace period ends) to make its GDPR adequacy decision, where it will determine whether the UK has an adequate level of data protection.

If the Commission decides that an external country’s data protection standards are adequate, then personal data can be sent from an EEA state to a third country without any further safeguard being necessary. If the outcome of the adequacy decision is positive for the UK, this will mean that UK businesses handling data belonging to individuals within the EU will be able to operate as before, without the need to take any further data protection measures.

On 19 February 2021, the Commission published a draft adequacy decision concluding that the UK ensures a similar level of protection to the EU for personal data as set out in:

• An adequacy decision under the EU GDPR, for personal data processed other than by the law enforcement sector; and
• An adequacy decision under the EU LED, for personal data processed by the law enforcement sector.

Whilst this draft decision appears to be a positive sign for UK business, this is only one step in a lengthy process before the UK can be approved as an ‘adequate’ third country. Before then, three crucial stages must be passed:

1. The European Data Protection Board will review the draft decision and provide their recommendation. Whilst the EDPB do not have the power to block an adequacy decision, the European Commission will take their opinion into account when making a formal decision.
2. The European Commission will then have to obtain formal approval from a committee of representatives of the EU Member States.
3. The European Commission can then formally adopt the adequacy decisions.

The publication of the draft adequacy decision seems to be good news for UK business, however the decision is by no means final. Moreover, even if the decision is formally adopted, it may not be a straight road ahead for UK business; there is the potential that the decision could be met with legal challenges in UK courts and there will also be a four-yearly review of the position by the European Commission.

It is highly advisable for UK companies to continue to carefully monitor updates on the UK GDPR adequacy decision, and to exercise caution when transferring data.

If you run a business and have any questions or queries concerning the GDPR adequacy decision, our team of experienced Corporate & Commercial solicitors are more than happy to advise. Get in touch with our team at enquiries@lawstep.co.uk for more information.