Draft adequacy decisions were published on 19 February 2021 by the European Commission (EC) for personal data transfers from the EU to the UK. The significance of the drafts are considerable given they are the first to be produced since the European Court of Justice’s (ECJ) ruling in Schrems II which struck down the adequacy decision previously granted to the EU-US Privacy shield.

The EC’s press release on the draft adequacy decisions stated that it has carefully assessed the UK’s law and practice on personal data protection, including the rules on public authorities access to personal data, and concluded that the UK ensures an ‘essentially equivalent’ level of protection to that guaranteed under the EU GDPR and Law Enforcement Directive.

What does adequacy mean?

‘Adequacy’ is a term that the EU uses to describe other countries, territories, sectors or international organisations that it deems to provide an ‘essentially equivalent’ level of data protection to that which exists within the EU. An adequacy decision is a formal decision made by the EU which recognises that another country, territory, sector or international organisation provides an equivalent level of protection for personal data as the EU does. The UK is seeking adequacy decisions under both the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED).

The effect of an adequacy decision is that personal data can be sent from an EEA state to a third country without any further safeguard being necessary. The trade deal agreed between the UK and the EU means that the UK has a bridge until 30 June 2021 where data can continue to flow from the European Economic Area (EEA) to the UK whilst the adequacy decisions process takes place. The bridge can finish sooner than this if the EU adopts adequacy decisions in respect of the UK.

Transfers of data from the UK to the EEA are permitted. The UK Government has recognised EU Commission adequacy decisions made before the end of the transition period. This allows restricted transfers to continue to be made from the UK to most organisations, countries, territories or sectors covered by an EU adequacy decision.

Adequacy criteria

For purposes of the draft adequacy decisions, the EC assessed (amongst other things) the following as it relates to the rules applying to the processing of personal data:

  • The UK’s constitutional framework – including, the existence of the UK Human Rights Act 1998 which incorporates the rights contained in the European Convention on Human Rights.
  • The UK’s data protection framework – in particular, the fact that the EU GDPR has been incorporated into UK law (UK GDPR) and as such, the UK’s legislative framework for data protection is closely aligned to that in the EU. This includes both the territorial and material scope of the UK GDPR, the definitions for key concepts under the UK GDPR (e.g., personal data), the data protection principles of the UK GDPR (e.g., fair and lawful processing), and the data protection rights afforded to individuals (for which a particularly detailed analysis of the exemptions to these rights is provided) – all of which are equivalent to those provided in the EU GDPR.
  • Onward transfers of personal data from the UK – in particular, the fact that the same restrictions on international transfers of personal data under the EU GDPR are provided in the UK GDPR in turn, safeguarding the onward transfer of EU personal data from the UK to another third country (e.g., the US).
  • Oversight and enforcement – the existence of the UK’s Information Commissioner’s Office (ICO) as an “independent supervisory authority tasked with powers to monitor and enforce compliance with the data protection rules” and the powers of enforcement granted to the ICO which are equivalent to those granted to EU data protection authorities under the EU GDPR. Interestingly, references to the number of cases investigated by the ICO (approximately 40,000 complaints from data subjects per year and 2,000 investigations) as well as the fines issued by the ICO under the EU GDPR, are both factors considered in the EC’s assessment.
  • Redress – the requirement that individuals are provided with effective administrative and judicial redress, including compensation for damages. The EC here references the ability for a data subject to: (a) complain to (and about) the ICO, (b) bring a claim against controllers and processors for material and non-material damages under the UK GDPR, and (c) bring a claim in UK courts under the UK’s Human Rights Act 1998 and ultimately in the European Court of Human Rights.

Consequences of adoption

If adopted, the draft adequacy decisions will be valid for an initial term of four years, only renewable if the level of protection in the UK continues to be adequate. The drafts include strict mechanisms for monitoring and review, suspension or withdrawal, to address any problematic development of the UK system which will no longer be bound by EU privacy rules.

UK government response to the draft adequacy decisions

The UK government has welcomed the draft adequacy decisions, urging the EU to fulfil its commitment to complete the approval process swiftly. The Information Commissioner described the progress as “an important milestone in securing the continued frictionless data transfers from the EU to the UK”.

The draft adequacy decisions are now with the EDPB for a “non-binding opinion”, following which the EC will request approval from EU member states’ representatives. It could then adopt final adequacy decisions. Until then, organisations continue to be able to receive personal data from the EU under the temporary “bridging mechanism”, agreed in the EU-UK Trade and Cooperation Agreement.

Schrems II

The draft adequacy decisions also include a detailed assessment of the conditions and limitations, as well as the oversight mechanisms and remedies applicable in case of access to data by UK public authorities, in particular for law enforcement and national security purposes. These are likely included to address the ECJ’s ruling in Schrems II and concerns over the UK’s use of mass surveillance techniques.

In Schrems II, the ECJ ruled that free data flows moving from the EU to certain US organisations under the EU-US privacy shield did not offer an essentially equivalent level of protection as under EU law. This was substantially based on the fact that national security laws in the US were deemed to undermine citizens’ data rights. When assessing the UK, the ECJ, in light of the ruling in Schrems II, was always going to pay close attention to UK national security laws. Additionally, Schrems II introduced more stringent obligations on organisations when carrying out cross border data transfers and so there has been a general concern that this newly stringent approach may reduce the UK’s chance of receiving an adequacy decision. The drafts can therefore be seen as a highly positive step.

What stands in the UK’s way?

Although the process for an adequacy decision under the EU GDPR is now underway with the draft adequacy decisions in place and, although the UK government has stated on a number of occasions that it is confident that the EU will deem the UK data protection regime ‘essentially equivalent’, it is worth noting that a number of issues may impact on the UK’s ability to satisfy the EU:

  • The UK’s use of mass surveillance techniques may lead to EU member states raising concerns about data protection in the UK, which might jeopardise an Adequacy Decision. The ruling of the ECtHR which held that aspects of the UK’s surveillance regimes under the Regulation of Investigatory Powers Act 2000 (RIPA) did not comply with Articles 8 and 10 of the ECHR, is particularly relevant (Big Brother Watch and others v United Kingdom). The human rights groups which brought the claim were not satisfied with the judgment and appealed to the Grand Chamber, the ECtHR’s highest judicial bench.
  • Membership of the Five Eyes intelligence sharing community means EU citizens’ data could be transferred by UK security services to third countries (including the US) which are not considered to have adequate data protection.
  • Potential for unprotected onward data transfers as the UK will be able to decide which countries it deems adequate and what arrangements to have with them.

The draft adequacy decisions – a positive step

Although nothing can be taken for granted, the draft adequacy decisions are a positive step and the fact that the UK has committed to remaining party to the ECHR and “Convention 108”, will likely carry some leverage as adherence to such international conventions is important for the stability and durability of adequacy findings.

If you have any questions on the draft adequacy decisions, data protection law more generally or on any of the issues raised in this article please get in touch with one of our data protection lawyers.