UK one step further to adequacy...

The European Commission has issued its draft decision bringing us one step nearer to seeing the UK being designated as "adequate" and therefor allowing the continual free flow of personal data between the UK and the EU. Once the decision has been approved this will replace the interim 4-6 months extension that was granted in the UK/EU trade deal.

View: the decision (albeit currently in draft) is welcome although not overly surprising considering that our current data protection regime is generally aligned with the EU. The decision will need to be approved by the member states and is subject to any concerns from the European Data Protection Board but it will hopefully provide businesses with some comfort that the risk of disruption of data flow between the UK and the EU is subsiding. There is inevitably some risk that as UK legislation diverges from the EU (especially in respect of security and surveillance), adequacy status will come under scrutiny and legal challenge. Indeed the decision includes a requirement for it to be reviewed every 4 years to ensure the UK still meets the requirements of Article 45 of the GDPR.