After the UK finally left the EU on 1 January 2021, the rules for international data transmission in the General Data Protection Regulation No. 2016/679 (GDPR) and the Directive on the exchange of personal data between law enforcement authorities No. 2016/680 (LED) will apply. Both EU regulations require that the Commission may decide, by means of an implementing act, that a third country ensures an adequate level of data protection. Under this condition, transfers of personal data to a third country may take place without the need to obtain any further authorisation (except where another Member State from which the data were obtained has to give its authorisation to the transfer).

On 19 February 2021, the Commission presented two proposals for adequacy decisions – one as required by the GDPR, another one as required by the LED. As stipulated in said EU regulations, the Commission carried out a detailed assessment of the UK’s relevant law and practice on data protection, e.g., the conditions and limitations as well as the oversight mechanisms and remedies applicable in case of access to data by UK public authorities, in particular for law enforcement and national security purposes. Based on its findings, the Commission concludes that the UK ensures an adequate level of protection for personal data transferred from private entities/competent authorities in the Union. Considereing that the UK rules are currently widely in line with the EU legislation since the UK implemented both the GDPR and the LED during its membership to the bloc, the Commission reserves the right to examine after four years whether the adequacy decisions would still be valid because the UK is no longer bound to EU privacy rules after Brexit.

The Commission drafts now start an adoption process. First, the European Data Protection Board (EDPB) must give an opinion. Second, Member States’ representatives must be addressed in the so-called comitology procedure in order to give green light to the Commission. Following that, the European Commission could adopt the final adequacy decisions for the UK.

At the moment, data transfers can be based on transition clauses as agreed in the Trade and Cooperation Agreement. Until 31 June 2021, the UK is still to be treated as an EU country in terms of data transfers, allowing EU companies or law enforcement agencies to exchange data with the UK under the same conditions as before Brexit (→ https://eucrim.eu/news/brexit-eu-uk-trade-and-cooperation-agreement-impacts-on-pif-and-jha-in-nutshell).

The EU’s adequacy decisions only concern the data flows from the EU to the UK. Data flows in the other direction – from the UK to the EU – are regulated by UK legislation.