While we may not be getting a trip to Europe any time soon, it looks like our data can continue enjoying access to sunnier climes. In January we reported on the EU-UK Trade and Cooperation Agreement. Via a mechanism called the “Bridge”, that agreement granted pseudo adequacy to the UK for four months (with the potential to extend to six months) from 1 January 2021, in order to allow the European Commission time to make its adequacy assessment.

Those companies that receive data from the EU will be heartened by the Financial Times (the “FT”) article, which reports (paywall) that a draft decision confirming the UK’s adequacy status has been made by the Commission. Such a decision means that personal data can continue to flow freely between the EU and the UK.

The FT confirms that the adequacy decision will be periodically reviewed by the Commission, and that it is open to challenge at the European Court of Justice. However, the International Association of Privacy Practitioners reports that, although privacy activists were emboldened by the privacy shield decision, they have joked that they are staying well clear of the ‘craziness’ of Brexit. One would therefore hope that UK adequacy (assuming this report is accurate) is here to stay in the near future at least.

The potential hurdle to long-term adequacy is a divergence of regulation. Currently UK and EU data regulation is strikingly similar, given that the UK adopted the General Data Protection Regulation into UK law. But Vera Jourova, the EU vice-president for values and transparency, stated that “We will need to be very vigilant that such developments do not undermine the level of protection we would have found to be adequate.” The adequacy arrangement will be reviewed every four years to ensure that UK rules have not significantly diverged from the EU’s, with the risk of adequacy being withdrawn if that is found to be the case.

Bar the risk of any serious tension between the UK and the EU arising in the interim and of course we all still need to watch this space until the ink is dry, we can expect a full adoption of the decision before 30 June 2021, when the pseudo adequacy agreement expires. This is welcome news and provides certainty to business that has long been missing.