UK granted data adequacy by the European Commission
The decision granting the UK data adequacy is welcomed by techUK members for whom maintaining interrupted data flows is a key concern emerging from the UK’s departure from the EU.
On 19 February 2021, the European Commission launched the process towards adopting two adequacy decisions after having assessed the UK’s data protection regime as providing an equivalent level of protection to the EU General Data Protection Regulation (GDPR) and the Law Enforcement Directive. These decisions, if adopted by the European Council, will grant the UK ‘data adequacy’ permitting the continued free flow of personal data between the European Economic Area (EEA) and the UK.
Under the EU GDPR transfers of personal data to non-EU/EEA countries are not automatically allowed, requiring an additional legal basis. Data adequacy decisions provide such a legal basis and are granted to countries which demonstrate an equivalent level of data protection to the EU GDPR.
Personal data was still able to be exchanged freely between the UK and the EU during the transition period between 31 January 2020 and 31 December. The EU-UK Trade & Cooperation Agreement (TCA) signed on 24 December 2020 included a bridging mechanism up until June 2021 to extend this as there was insufficient time for the European Commission to complete its data adequacy assessment before the end of the transition period.
The decision will now be scrutinised by the European Data Protection Board which will give an opinion on the Commission's assessment. After the opinion is given, the decision will progress to comitology before a final decision is taken by the European Council.
If the adequacy decisions are adopted, companies based in the UK that want to continue transferring data from the EU to the UK will not need to put in place an additional legal basis, such as Standard Contractual Clauses (SCCs), to transfer personal data with the EEA. The adequacy decision will be reviewed after four years.
Since the day after the 2016 EU referendum, techUK members with bases in the UK and the EU have advocated for the continued free flow of data between the UK and the EU as one of their core priorities.
According to a report by the New Economics Foundation and the UCL European Institute, the additional compliance obligations resulting from not receiving data adequacy could have cost the UK economy up to £1.6 billion.
The decision by the European Commission that the UK is adequate is significant for both the UK and EU tech sectors which raised a combined $41bn in investment in 2020 and are at heart of the post-COVID 19 economic recovery plans. Combined with the non-discrimination and data flows provisions within the UK-EU TCA, this decision will enable UK and EU technology companies to access the maximum benefits from the new UK-EU trading relationship.
Commenting on the data adequacy decisions, techUK CEO Julian David said:
The European Commission decision that the UK’s data protection regime offers an equivalent level of protection to the EU GDPR is a vote of confidence in the UK’s high data protection standards. Today's decisions are warmly welcomed by the tech sector which has been making clear the importance of a mutual data adequacy agreement since the day after the referendum. Receiving data adequacy, alongside the EU-UK Trade and Cooperation Agreement, will set a solid foundation for digital trade with the EU, including strong non-discrimination clauses and positive data flows provisions, that will give businesses the confidence to invest. As we go forward, the UK must also complete the development of its own international data transfer regime, allowing UK companies not just to exchange data with the EU, but also to be able to access global opportunities.
Latest News from
Guest Blog: 2021 - The Super Year for Sustainability and Climate Policy26/02/2021 16:25:00
In November, 168 states will provide National Climate Plans (NDCs) ahead of the United Nations’ 26th Climate Summit (COP).
Smart technology empowering smart people26/02/2021 14:38:00
Guest blog by Paul O'Hanlon, Divisional Chief Architect, Leidos UK.
Scotland’s new Cyber Resilience Framework26/02/2021 12:43:00
The Scottish Government sets out its new strategy to ensure Scotland is a digitally secure and cyber resilient nation.
techUK launches landmark report on the future of the UK’s digital twin ecosystem26/02/2021 10:20:00
As the UK looks to respond, adapt, and recover from the COVID-19 pandemic, urgent, sustained, and collective action will be needed to reignite different layers of our economy and society.
A new timeline for reopening the economy in England, what does this mean for techUK members?25/02/2021 11:20:00
The UK Government has set out four steps to enable a return to normality for England in a Spring update to the COVID-19 pandemic strategy
NHSX launches Digital Technology Assessment Criteria25/02/2021 10:20:00
NHSX has launched this week the Digital Technology Assessment Criteria (DTAC), setting the national baseline for digital technology used in the NHS and social care.
The 2021 March budget should prioritise tech-led growth to ensure a strong economic recovery24/02/2021 16:05:00
The March 2021 Budget is an opportunity for the Chancellor to lay out his plans for future economic growth and recovery, while also continuing to support the sectors of the economy hit hard by the COVID-19 pandemic.
Calling all innovators - entries to the Mayor of London's Resilience Fund are now open24/02/2021 14:38:00
Open call to innovators to apply to the Mayor’s Resilience Fund by 1 April 2021.
Guest blog: Unboxed's Women in Tech interview series24/02/2021 11:25:00
Read techUK member Unboxed's first interview from the series, which tells the story of Rhian Lewis, developer and author.