On 19 February 2021, the EU Commission published its draft adequacy decision allowing personal data transfers from the EU to the UK under the GDPR. It is a welcome new development in the Brexit saga.
To become final, the decision must receive i) the opinion from the European Data Protection Board (the so-called EDPB) on the adequacy of the level of protection and ii) the green light from a committee of representatives of the EU Member States.
The EDPB opinion is not binding as such, but the Commission is likely to consider it to provide further details on the adequacy findings.
Once adopted, this decision will allow businesses to keep transferring personal data from the EU to the UK under the same rules as before Brexit.
The decision will replace the current interim Bridge agreed between the EU and the UK in the Brexit deal allowing companies to continue transferring personal data to the UK until 30 June 2021.
Once adopted, the adequacy decision will be re-examined at intervals of a maximum of four years to ensure that the UK rules do not hinder EU citizens' privacy.
The draft decision is available here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
