EU grants the UK provisional ‘data adequacy’ status

The UK criticises the EU for not already reaching this agreement prior to the formal Brexit withdrawal date

EU represented in clouds

The European Commission (EC) has published a draft data adequacy decision for the UK, ensuring that data will continue to flow undisrupted from the EU to the UK.

The EU has concluded that the UK ensures an “essentially equivalent” level of data protection to both the General Data Protection Regulation (GDPR ) and the Law Enforcement Directive (LED). 

Brexit threatened to disrupt data flows because the UK had been relegated to a ‘third country’ by default, effectively putting an end to the free flow of data and information from the EU to the UK. This would have posed a massive challenge to businesses based in the UK that held or stored data in servers abroad, for example. Academic modelling also showed that the lack of such an agreement would have cost businesses up to £1.6 billion.

Although the UK managed to guarantee a six-month transitional period from the beginning of the year, the only way to permanently ensure data would continue to flow was by securing a data adequacy agreement. This would establish the UK as a secure ‘third country’ with harmonised data protection laws and practices. 

As part of the agreement, the EU will review the adequacy agreement at most every four years and monitor developments in the UK, as well as take note of other relevant international agreements the UK strikes. As such, the formal agreement can be revoked at any time in the future when it’s eventually struck, if the UK waters down its data protection laws to such an extent that they’re no longer essentially equivalent to GDPR.

“Ensuring free and safe flow of personal data is crucial for businesses and citizens on both sides of the Channel,” said Věra Jourová, the EU’s vice president for values and transparency. 

“At the same time, we should ensure that our decision will stand the test of time. This is why we included clear and strict mechanisms in terms of both monitoring and review, suspension or withdrawal of such decisions, to address any problematic development of the UK system after the adequacy would be granted.”

The UK government has welcomed the draft decision, suggesting that international data flows are essential in a world that’s becoming increasingly connected. Technical confirmation of the draft decision will help to ensure that UK businesses and organisations across various sectors can continue to operate undisrupted and without having to face extra costs.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The draft decisions published by the EC will now be shared with the European Data Protection Board (EDPB) for its non-binding opinion, before being presented to EU member states for formal approval.

The government added in its press release that it “made representations to the EU in a timely manner”, but that the European Commission failed to finalise draft decisions before the transitionary period ended.

“For this reason,” the statement continued, “as part of the UK/EU Trade and Cooperation Agreement, a time-limited bridging mechanism’ for personal data flows was agreed. This currently allows personal data to continue to flow as it did before the end of the Brexit transition period for up to six months, while the EU completes the adequacy process.

“The UK government now urges the EU to swiftly complete this technical process for adopting and formalising these adequacy decisions as early as possible.”

This bridging mechanism will remain in place until 30 June, or until the formal adequacy decisions come into effect. 

The Information Commissioner’s Office (ICO), which has prepared guidance and material for businesses over the last few years to prepare them for all eventualities, also welcomed the decision, branding it an important milestone. Information Commissioner Elizabeth Denham said the announcement gets the regulator a step closer to having a clear picture for organisations processing personal data from the EU.

Featured Resources

Edge-enabled mobility of the future

Turning vehicle data into value

Download now

Modern networking for the borderless enterprise

Five ways top organisations are optimising networking at the edge

Download now

Address multi-cloud configuration risks

Cloud security challenges and how to overcome them

Watch now

The total economic impact of IBM Security Verify

Cost savings and business benefits enabled by IBM Security Verify

Download now

Recommended

Ten ways to protect your company from the next big data breach
data breaches

Ten ways to protect your company from the next big data breach

5 Mar 2021
Four tips for keeping your business secure during mass remote work
data protection

Four tips for keeping your business secure during mass remote work

19 Feb 2021
Cost of a data breach report 2020
Whitepaper

Cost of a data breach report 2020

2 Feb 2021
Misconfigured Git servers lead to Nissan data leak
hacking

Misconfigured Git servers lead to Nissan data leak

7 Jan 2021

Most Popular

UK gov flip-flops on remote work, wants it a standard for all jobs
flexible working

UK gov flip-flops on remote work, wants it a standard for all jobs

5 Mar 2021
Star Alliance passenger data stolen in SITA data breach
data breaches

Star Alliance passenger data stolen in SITA data breach

5 Mar 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

26 Feb 2021