Greetings from Brussels!

There was some movement this week within the EU process in what concerns an eventual U.K. adequacy decision. To recap, you will recall that 19 Feb., the European Commission provisionally gave the thumbs up to adopt two adequacy decisions for the transfer of personal data to the U.K. As is the process and following a thorough technical assessment, the commission found the U.K.'s data protection regime provided an equivalent level of protection in line with both the GDPR and Law Enforcement Directive.

An important step in the conferring of a U.K. adequacy decision is the European Data Protection Board's opinion based on the commission's draft decision proposals. Two opinions (Opinion 142021 and Opinion 152021) were released this week specific to provisions of both the GDPR and LED, respectively. It is worth noting this is also the first draft implementing decision on a third country's adequacy under the LED presented by the European Commission and assessed by the EDPB. 

In conclusion, the regulatory opinion is one of overall approval. In a news release, the EDPB acknowledged key areas of mutual alignment between the EU and U.K. data protection frameworks. This was to be expected in that the U.K. regime was for all practical purposes, and until very recently, that of the EU. Moreover, the U.K.'s regulatory authority, the ICO, under U.K. membership of the EU, was instrumental and a key contributor to the design and implementation of the GDPR. All said, the EDPB cautioned against eventual changes to the U.K. Data Protection Act of 2018 and to U.K. law (generally). EDPB Chair Andrea Jelinek said, "…whilst laws can evolve, this alignment should be maintained. We welcome the Commission's decision to limit the granted adequacy in time and the intention to closely monitor developments in the U.K."

Several items were highlighted that the EDPB states should be assessed and monitored more closely. For example, in what concerns the GDPR, the issue of data processing and immigration control. U.K. data protection law contains a broad-based derogation from aspects of fundamental data protection principles, such as the right of access and the rights of data subjects. Another issue that receives particular attention is the question of onward transfers of EEA personal data and the application of restrictions. How will U.K. adequacy decisions to other third countries come into play, including U.K. international trade agreements provisions or additional derogations? Global data flow and supply chains remain complex.

Regarding potential access to EEA personal data by U.K. public sector actors and agencies for reasons of national security, the EDPB welcomes the introduction of new concepts, such as the Investigatory Powers Tribunal for challenges of redress in this area and the inclusion of Judicial commissioners' oversight functions to the Investigatory Powers Act of 2016. There remains, however, some question over U.K. bulk interception and retention powers and international intelligence (data) sharing operations and arrangements that the U.K. is engaged in. The EDPB asks the commission to seek clarification and maintain a level of monitoring to ensure reasonable safeguards for EU citizens and their personal data.  

The EDPB opinions will be presented to the European Parliament LIBE committee next week, and there is clearly a lot of interest and expectation ahead. Although it is important to note that adequacy decisions are implementing acts of the EU executive, the Parliament has limited power to alter or block such decisions. The commission fully expects to have approval from the EU member states before adoption and before time runs out on the six-month extension mechanism in place for continued transfers, which end in June.