The much anticipated adequacy decision for transfers of personal data to the UK has reached a new milestone today. The European Commission has started the process to adopt not one but two adequacy decisions – one under the GDPR and the other for the Law Enforcement Directive, using the powers in Article 45(3) GDPR and Article 36(3) LED respectively.

While this is an important step, it is worth remembering the publication of the draft decisions is only the beginning of the process. The EDPB will be consulted for an opinion and after taking this into account the Commission will ask a committee of representatives from EU Member States to give the go ahead (the comitology procedure). Only following the successful completion of these stages can the Commission adopt the final adequacy decisions for the UK.

Why is this so important?

If the UK, as a non-EU country, has been found “adequate”, in other words it ensures an “adequate level of protection for personal data that is essentially equivalent to the level of protection in the EU”, transfers of personal data from the EU to the UK can “take place without being subject to any further conditions.” While UK legislation governs data flows from the UK to the EU, data flows from the EU to the UK are subject to a “conditional interim regime” that was agreed in the EU-UK Trade and Cooperation Agreement. This interim period initially runs until 30 April 2021, with the option to extend it to 30 June 2021. Businesses that receive data from the EU will be looking forward to the certainty which an adequacy decision will bring.

That said, as Sean Illing pointed out in his article earlier this week (European Commission on the verge of granting 'adequacy' to the UK) the adequacy decision will be periodically reviewed every 4 years by the Commission, and the decision is open to challenge at the European Court of Justice. This review mechanism is evident in Věra Jourová, Vice-President for Values and Transparency, announcement as she said:

“Ensuring free and safe flow of personal data is crucial for businesses and citizens on both sides of the Channel. The UK has left the EU, but not the European privacy family. At the same time, we should ensure that our decision will stand the test of time. This is why we included clear and strict mechanisms in terms of both monitoring and review, suspension or withdrawal of such decisions, to address any problematic development of the UK system after the adequacy would be granted.”

While the draft decisions are a step towards greater certainty there are still the political hurdles to overcome before this is signed and sealed. However, given an adequacy decision has never been challenged or overturned before we can be cautiously optimistic and watch this space.