IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

EU grants the UK provisional ‘data adequacy’ status

The UK criticises the EU for not already reaching this agreement prior to the formal Brexit withdrawal date

The European Commission (EC) has published a draft data adequacy decision for the UK, ensuring that data will continue to flow undisrupted from the EU to the UK.

The EU has concluded that the UK ensures an “essentially equivalent” level of data protection to both the General Data Protection Regulation (GDPR ) and the Law Enforcement Directive (LED). 

Brexit threatened to disrupt data flows because the UK had been relegated to a ‘third country’ by default, effectively putting an end to the free flow of data and information from the EU to the UK. This would have posed a massive challenge to businesses based in the UK that held or stored data in servers abroad, for example. Academic modelling also showed that the lack of such an agreement would have cost businesses up to £1.6 billion.

Although the UK managed to guarantee a six-month transitional period from the beginning of the year, the only way to permanently ensure data would continue to flow was by securing a data adequacy agreement. This would establish the UK as a secure ‘third country’ with harmonised data protection laws and practices. 

As part of the agreement, the EU will review the adequacy agreement at most every four years and monitor developments in the UK, as well as take note of other relevant international agreements the UK strikes. As such, the formal agreement can be revoked at any time in the future when it’s eventually struck, if the UK waters down its data protection laws to such an extent that they’re no longer essentially equivalent to GDPR.

“Ensuring free and safe flow of personal data is crucial for businesses and citizens on both sides of the Channel,” said Věra Jourová, the EU’s vice president for values and transparency. 

“At the same time, we should ensure that our decision will stand the test of time. This is why we included clear and strict mechanisms in terms of both monitoring and review, suspension or withdrawal of such decisions, to address any problematic development of the UK system after the adequacy would be granted.”

The UK government has welcomed the draft decision, suggesting that international data flows are essential in a world that’s becoming increasingly connected. Technical confirmation of the draft decision will help to ensure that UK businesses and organisations across various sectors can continue to operate undisrupted and without having to face extra costs.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

The draft decisions published by the EC will now be shared with the European Data Protection Board (EDPB) for its non-binding opinion, before being presented to EU member states for formal approval.

The government added in its press release that it “made representations to the EU in a timely manner”, but that the European Commission failed to finalise draft decisions before the transitionary period ended.

“For this reason,” the statement continued, “as part of the UK/EU Trade and Cooperation Agreement, a time-limited bridging mechanism’ for personal data flows was agreed. This currently allows personal data to continue to flow as it did before the end of the Brexit transition period for up to six months, while the EU completes the adequacy process.

“The UK government now urges the EU to swiftly complete this technical process for adopting and formalising these adequacy decisions as early as possible.”

This bridging mechanism will remain in place until 30 June, or until the formal adequacy decisions come into effect. 

The Information Commissioner’s Office (ICO), which has prepared guidance and material for businesses over the last few years to prepare them for all eventualities, also welcomed the decision, branding it an important milestone. Information Commissioner Elizabeth Denham said the announcement gets the regulator a step closer to having a clear picture for organisations processing personal data from the EU.

Featured Resources

Meeting the future of education with confidence

How the switch to digital learning has created an opportunity to meet the needs of every student, always

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

Technology reimagined

Why PCaaS is perfect for modern schools

Free Download

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Delivery firm Yodel disrupted by cyber attack
cyber attacks

Delivery firm Yodel disrupted by cyber attack

21 Jun 2022
Salaries for the least popular programming languages surge as much as 44%

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022