The short-term outlook for data flows between the European Union and U.K. has grown more stable with a proposed extension by the European Commission of its two U.K. adequacy determinations from 2021. The deadline for U.K. adequacy is currently set for 27 June, but the proposed six-month extension would move the deadline back to 27 Dec.
Commissioner for Democracy, Justice, the Rule of Law, and Consumer Protection Michael McGrath said, "The adequacy decisions are key to our relationship with the UK. They ensure data can flow freely and safely, which is crucial for trade, justice, and law enforcement cooperation. Our proposal will allow the Commission to assess whether to renew these decisions based on a stable legal framework, while keeping data flows to the UK uninterrupted."
The proposal comes as the U.K. Parliament moves to pass the Data Use and Access Bill. At the IAPP Data Protection Intensive: UK 2025, U.K. Minister of State for Data Protection and Telecoms Chris Bryant said the bill was in its final states and would be finished "by Easter or a couple weeks after."
As part of the proposal, the draft extensions will be sent to the European Data Protection Board for its opinion on and approval of the adoption procedure.
The extension would take some pressure off the adequacy procedure as the U.K. finalizes the DUA legislation. The bill is in the report stage with the House of Commons and will undergo a third reading before reaching final stages, with an additional consideration of amendments and then Royal Assent.
In comments to the IAPP, Bates Wells Partner and Head of Data and Privacy Eleonor Duhs, CIPP/E, said the news was not surprising. "Something similar has happened before," she said. "The EU and the U.K. managed to negotiate the entire EU-U.K. Trade and Cooperation agreement between March and December 2020, but U.K. adequacy took significantly longer to put in place. The European Commission's review of the 11 adequacy decisions made under the 1995 Directive also took far longer than many had envisaged."
This latest reform package is the third attempt by the U.K. to modernize data use and privacy protections after the proposed Data Protection and Digital Information Bill did not pass prior to last July's national elections. The bill would also bring organizational reform to the Information Commissioner's Office, which recently announced fresh regulatory commitments to spur economic growth under the U.K. government's growth agenda.
"It is important for us to maintain relations with the EU," Minister Bryant said last week. He added he is hopeful the new bill will meet the EU's adequacy requirements.
With a potential extension, Duhs does not expect the U.K. bill will be delayed. "The government is keen to get the legislation on the statute book," she said. "The only proviso is if there is something in the bill that the Commission wants removed (or indeed something which they consider should be added) in order for adequacy to be conferred."
But, she said, that this would be unlikely. "If this had been the case, I would have expected the relevant amendments to be made before this late stage."
Reading the tea leaves, Duhs emphasized Commissioner McGrath's wording in today's daily briefing. "It emphasizes the importance of the free flow of data from the EU to the U.K., which is described as 'crucial for trade, justice, and law enforcement cooperation.' This should give reassurance to organisations in both the U.K. and the EU that both sides want U.K. data adequacy to continue."
Jedidiah Bracy is the editorial director for the IAPP.
