On 28th June, 2021 the European Commission finally adopted two adequacy decisions concerning personal data protection in favor of the UK – one under the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive.
This means that the personal data will be transferred freely to the UK as it benefits from an essentially equivalent level of protection to that guaranteed under EU legislation. Both decisions provide strong safeguards in case of future change of the internal legislation in the United Kingdom – such safeguard is the “sunset clause” which limits the duration span of the decisions for 4 years.
In the recitals to the decision it has been agreed that the UK law has already adopted the same rules that were applicable when the UK was a Member State of the EU. The UK has already managed to fully incorporate the principles, rights and obligations provided in the GDPR and the Law Enforcement Directive into its legal system.
For the first an adequacy decision is provided with expiration date which means that it will automatically expire four years after its entry into force (on 27th June, 2025). After expiring the adequacy decisions may be prolonged if the United Kingdom continues to ensure adequate level of protection of the personal data. During the 4-year period the European commission will continue to monitor the legislation of the UK and if it finds deviation it may decide to revise its decisions.
The case with the data processing by the UK authorities which was the biggest concern before the adoption of the decisions has been successfully solved in the internal legislation of the UK – now, the collection of data by intelligence authorities is subject to prior authorisation by an independent judicial body. Moreover, if someone believes they have been subject of unlawful surveillance may bring an action before the Investigatory Powers Tribunal – а judicial body which operates independently of the government and investigates personal data breach cases.
Personal data flow for the purposes of UK immigration control is excluded from the scope of the adequacy decision adopted under the GDPR in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area.