On 13 April 2021, the European Data Protection Board (EDPB) adopted two Opinions on the draft UK adequacy decisions: (i) Opinion 14/2021 for transfers of personal data under the EU General Data Protection Regulation (EU GDPR); and (ii) Opinion 15/2021 for transfers of personal data under the Law Enforcement Directive (LED).
Whilst the Opinions have not yet been published, the EDPB has confirmed in a press release that it has identified “many aspects [of the UK data protection framework] to be essentially equivalent” to the EU data protection framework. However, the EDPB Chair, Andrea Jelinek, acknowledged that “laws can evolve” and therefore that the EDPB “welcome[s] the [European] Commission’s decision to limit the granted adequacy in time” to ensure continued alignment with the EU data protection framework in the future. The EDPB also identified in its press release certain areas which it considers require further clarification and/or monitoring by the Commission including, with respect to access by UK public authorities to EU personal data for national security purposes.
In terms of next steps, the draft UK adequacy decisions will now be assessed by representatives of the EU Member States in the ‘comitology procedure’. The Commission is then able to adopt the draft UK adequacy decisions – hopefully prior to the end of the bridging period at the end of June 2021.
This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.