The European Commission of February 19, 2021, published 2 (two) draft adequacy decisions (“Draft Decisions”) for transfer of personal data to the United Kingdom (“UK”), one under the General Data Protection Regulation (“GDPR”) and the other for the Law Enforcement Directive. The process of adequacy assessment for the UK had begun in March 2020 and the UK had supplied comprehensive explanatory material to the EU nearly a year before the start of the assessment. The Draft Decisions shall be followed with obtaining an opinion from the European Data Protection Board (EDPB) and further approval from a committee that is composed of representatives of the EU member states. Following this process, the EU would adopt the Draft Decisions. The Draft Decisions, when adopted would be valid for the first period of 4 (four) years in order to ensure that the UK privacy regime is future proof since now the UK is not bound by EU laws. After the expiry of 4 (four) years, the EU would assess if the level of protection in the UK continues to be adequate and renew the adequacy finding thereafter.
The adequacy decision flows from Article 45(3) of the GDPR, under which the EU may assess the level of protection of a third country to provide an adequacy decision to the third country, followed by a periodic review, at least every 4 (four) years. Further, under Article 36(3) of the Law Enforcement Directive the EU is granted similar powers of assessing the adequate level of protection, and by means of an implementing act, granting the third country an adequacy decision.
It shall also be noted that on December 24, 2020, the EU-UK Trade and Cooperation Agreement (“Trade Agreement”) had been executed, under which a time limited 'bridging mechanism' for the transfer of personal data was agreed. Under the Trade Agreement, personal data shall be allowed to flow between the EU and the UK as it did before the end of the BREXIT transition period up till June 30, 2021, or until when the Draft Decisions are finalised. Such an interim relief would provide for relaxation to businesses transferring personal data to the UK.
The Draft Decisions provide for a detailed assessment of procedures and limitations to be in place, as well as oversight mechanisms with remedies that may be applied in case access of personal data to national security agencies or law enforcement personnel of the UK.
Authored by Shivani Agarwal, Founder and Samaksh Khanna, Co-founder.
Comentários