Good news from the EU on data protection

22 June 2021

As long ago as 2019, the UK Government confirmed that, following the decision to leave the EU, it was introducing the “UK GDPR” which is essentially the EU’s General Data Protection Regulation (2016/679) with necessary changes such as introducing references to the Information Commissioner's Office (ICO) in place of the European Commission.

Although this left the UK seemingly in step with the EU on data protection, the Commission still had to confirm that, now the UK is a “third country”, its regime offers an equivalent level of protection to that afforded under EU law.

Its deliberations included consulting the European Parliament which asked the Commission to modify its draft adequacy decisions to bring them into line with the latest EU court rulings and to respond to concerns raised by the European Data Protection Board (EDPB) in its recent opinions.

MEPs said that they accepted that the UK’s basic data protection framework is similar to that of the EU, but raised concerns about the way it had been implemented.

In particular, they said, the UK regime contains exemptions in the fields of national security and immigration, which now also apply to EU citizens wishing to stay or settle in the UK.

However, the deadlock seems to have broken with a decision by the European Council to ratify a Data Adequacy agreement approving the UK as having adequate data protection for the transfer of personal data.

This means that the European Commission is likely to finalise its own adequacy decisions in July.

CBI Head of EU Negotiations, Russell Antram, said: “Securing a positive decision on data adequacy from the EU was a priority for thousands of businesses across the UK — and today’s announcement will be a massive relief. The free flow of data between the UK and the EU is essential for businesses across the economy — from automotive to logistics — playing an important role in everyday trade of goods and services.”

CEO of the Data and Marketing Association, Chris Combemale, agreed that the decision would be a huge relief for thousands of businesses across the UK.

“The UK can now progress new data legislation, such as the crucial National Data Strategy, knowing that a high-standards and innovation-focused approach rests in harmony with the European perspective,” he said.