Well what a week of debating, disagreeing and split voting! No I’m not talking about the Eurovision Song Contest, rather the ongoing European adequacy process for the UK.

Members of the European Parliament (MEPs) spent the last week debating and voting on various resolutions on UK adequacy. The rhetoric dialled up a notch and Rapporteur Juan Fernando López Aguilar was quoted as saying:

“The Civil Liberties Committee considers that a decision on adequacy should be granted only after the specific elements of UK law or practice that are still a matter of serious concern have been properly assessed. Therefore, we call on the Commission to modify the implementing decision to avoid repeating previous mistakes.”

The points of contention remain the same, namely national security, immigration, bulk access to data, bulk retention of data, onward transfers and international agreements. For more information on these issues see our article “Another step closer for the UK adequacy decisions?”.

Meanwhile several European business and industry organisations called on the EU Parliament to approve a draft resolution in favour of the UK. Data transfers are important to the EU economy and ever more so as countries look to recover from the Covid-19 pandemic. It is widely recognised that the global digital economy is worth trillions of pounds and in order to benefit from the opportunities business and industry must be able to participate. Of course this need must be balanced with data subjects' rights, data accuracy and quality, data security, adequate protections on data transfer etc. You need only look at the Schrems II decisions from various European Regulators and the response to attempts at so called data localisation to see this balancing act in practice.

So what happens now?

MEPs voted on Friday 21 May 2021 and passed a resolution asking the Commission to modify its draft decisions on UK adequacy in order to bring them into line with EU law and CJEU rulings and to answer the concerns raised by the European Data Protection Board in their Opinions. The resolution also includes a strong indication of the basis of a potential future challenge to any unamended Commission decision, with paragraph 35 stating:

[The European Parliament]“[t]akes the view that by adopting the two implementing decisions, which are not consistent with EU law, without having addressed all the concerns expressed in the present resolution, the Commission is going beyond the implementing powers conferred upon it by Regulation (EU) 2016/679 and Directive (EU) 2016/680; therefore objects to the two implementing acts on the basis that the draft implementing decisions are not consistent with EU law;”.

As any adequacy decision is an “implementing act”, the European Parliament has limited power to revise or block such an act, and really only has a “right to object” if it believes the Commission has overstepped its implementing powers. By clearly stating this in the resolution the European Parliament may be hoping this is persuasive at best or failing that a clear indication of what it sees the next steps will be.

It is now back to the Commission to make the next move, ever mindful of the end of the bridging provision on 30 June 2021, which is only 5 weeks away...