During its 48th Plenary Session, the European Data Protection Board (EDPB) adopted its two Opinions on the European Commission’s adequacy decisions on the UK.
Although the EDPB acknowledges that there are key areas of strong alignment between the EU and the UK data protection frameworks, they also empathise that this alignment should be maintained in the future, so the EDPB points out that they “welcome the Commission’s decision to limit the granted adequacy in time and the intention to closely monitor developments in the UK.”
In the press release issued yesterday, the EDPB outlines the following two items that they consider should be further assessed and closely monitored by the European Commission:
- The Immigration Exemption included in the UK legislation (which applies in relation to data subject rights in the context of immigration-related activities) and its consequences on restrictions on data subject rights;
- Onward transfers of EEA personal data transferred to the UK, on the basis of, for example, future adequacy decisions adopted by the UK or international agreements signed by the UK.
Furthermore, regarding access by public authorities for national security purposes to personal data transferred to the UK, the EDPB still identifies a number of points requiring further clarifications, which include:
- Bulk interceptions by British law enforcement agencies;
- Independent assessment and oversight of the use of automated processing tools;
- Safeguards provided under UK law when it comes to overseas disclosure, in particular in light of the application of national security exemptions.
Next steps
The draft decisions published by the European Commission have been sent to the European Data Protection Board for consultation purposes only. Now the European Commission will have to consider whether, in view of the EDPB’s Opinions, any amendments to the draft adequacy decisions are required before requesting approval from Member States’ representatives to adopt the final adequacy decisions for the UK.
The timeframe for completing this process is not defined, but in the meantime data flows between the EU/EEA and the UK will remain safeguarded under the interim regime agreed in the EU-UK Trade and Cooperation Agreement until 30 June 2021.
Link to the EDPB’s 48th Plenary Session Press Release: https://edpb.europa.eu/news/news/2021/european-data-protection-board-48th-plenary-session_en
