September 24, 2021

Volume XI, Number 267

Advertisement

September 24, 2021

Subscribe to Latest Legal News and Analysis

September 23, 2021

Subscribe to Latest Legal News and Analysis

September 22, 2021

Subscribe to Latest Legal News and Analysis

EU-UK Adequacy Decisions Finalized

On 28 June 2021, within 48 hours of the expiration of the post-Brexit grace period under the UK-EU Trade and Cooperation Agreement, the European Commission has adopted two adequacy decisions addressing the transfers of personal data to the United Kingdom under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive, respectively (together, the UK Adequacy Decisions).

Both texts prohibit the transfer of personal data to “third countries” unless (a) the destination country benefits from (i) an adequacy decision or (ii) appropriate safeguards, such as standard contractual clauses (see our alert here) or codes of conduct (see our alert here); or (b) one of the limited derogations under Article 49 GDPR applies.

The UK Adequacy Decisions will allow a seamless flow of personal data between the United Kingdom and the European Union, concluding a six-month race against time (see our alert here).

Key Points to Note:

  1. Despite the severe concerns raised by the European Data Protection Board in its Opinion 14/2021, due to the United Kingdom’s national security, intelligence, and surveillance regime, the European Commission deemed that the United Kingdom provided for “strong safeguards” in relation to access to personal data by public authorities for national security reasons. 

  2. The European Commission will closely monitor any evolution in the UK data protection framework that would lead to divergence with the EU regulations. This is particularly relevant because the United Kingdom announced it could revise its privacy framework for a more liberal approach in the coming months (see the Final Report from the Task Force on Innovation, Growth and Regulatory Reform), foreshadowing the UK government’s National Data Strategy, currently under consideration. As such, the European Commission may intervene at any given point to repeal the UK Adequacy Decisions.

  3. The UK Adequacy Decisions are subject to a sunset clause, i.e., unless expressly renewed, based on a new assessment of the UK regulatory framework, the UK Adequacy Decisions will expire in four years. This is markedly a different process from prior adequacy decisions, which typically renew by default without any need to go through a new review and adoption process. The addition of the sunset clause seems to suggest that the United Kingdom’s cards have been marked, and if the relationship between the United Kingdom and the European Union deteriorates in the next few years, this could mean the end of EU-UK adequacy at that time.

  4. For the time being, any personal data transfers relating to UK immigration control are excluded from the scope of the UK Adequacy Decisions, pending remediation under UK law.

  5. While the United Kingdom now belongs to the increasing group of third countries benefiting from an adequacy decision (including Japan and the Republic of Korea), it does not relieve companies subject to the UK data protection framework from the requirement to appoint an EU representative under Article 27 GDPR or, similarly, for EU companies subject to the UK GDPR to appoint a representative in the United Kingdom.

Copyright 2021 K & L GatesNational Law Review, Volume XI, Number 181
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Claude-Étienne Armingaud, KL Gates, Paris, data protection lawyer, commercial contracts attorney
Partner

Claude-Etienne Armingaud’s practice focuses on the representation of public and private companies in the area of information technologies and intellectual property law. Mr. Armingaud provides counsel to his clients at all stages of their corporate life cycle and in wide-ranging transactions, including in connection with litigation compliance matters, intellectual property protection and development, data protection strategic operations, and other commercial contracts.

Mr. Armingaud regularly advises start-up companies in matters relating to...

33-0-1-58-44-15-16
Sunny J. Kumar Intellectual Property Attorney K & L Gates Law Firm
Associate

Sunny Kumar is a senior associate at the firm’s London office. He is a member of the IP procurement and portfolio management practice group.

Prior to joining the firm, Mr. Kumar served as a senior associate for a magic circle law firm based in London. Mr. Kumar is an intellectual property lawyer and advises on contentious and non-contentious trademark, copyright, patent, design, advertising, licensing, commercial and data privacy matters. He has extensive experience in working with clients on their strategic IP projects across multiple...

+44.(0)02073608104
Noirin M. McFadden, KLGates, trade mark licensing lawyer, distribution agreements attorney
Associate

Nóirín McFadden is an associate in the firm’s London office. She concentrates her practice on Intellectual Property, Technology and Commercial matters. Nóirín has experience in data and trade mark licensing and in distribution agreements and has also worked on a range of technology matters including software licensing and online agreements. Nóirín advises on wide-ranging data protection issues, including data transfers.

44-0-20-7360-8135
Keisha Phippen IP Procurement & Portfolio Management Attorney K&L Gates London, UK
Associate

Keisha Phippen is an associate in the firm’s London office where she is a member of the IP procurement and portfolio management practice group.

Professional Background

Prior to joining the firm Ms. Phippen served as a commercial lawyer at a full service law firm based in the UK where she provided specialist advice on a range of commercial matters; drafted and developed a wide variety of standard and bespoke commercial documents; and supported clients with all-party contractual negotiations through to post completion queries.

Primary Practice

  • IP...

44.(0)20.7360.8267
Advertisement
Advertisement
Advertisement