The European Commission has published two draft adequacy decisions in respect of transfers of personal data from the EU to the UK, one under the GDPR and one under the Law Enforcement Directive.
If these draft decisions are adopted, they would permit the continued transfer of personal data from the EU to the UK without the need for additional transfer tools such as the standard contractual clauses.
The next steps in the process are an opinion from the European Data Protection Board ("EDPB") and approval by a committee of representatives from EU Member States. After these steps have been completed, the European Commission could adopt the final adequacy decisions for the UK.
The EU-UK Trade and Cooperation Agreement currently allows for transfers of personal data from the EU to the UK to continue without additional measures such as the standard contractual clauses. This interim arrangement is in place until 30 June 2021. If adopted, the adequacy decisions would provide a longer term solution for continued transfers of personal data from the EU to the UK once.
If adopted, these adequacy decisions will be valid for an initial period of four years. After that four year period, it would be possible to renew the adequacy finding if the level of protection in the UK continues to be "adequate".
Compared to other non-EU countries where convergence is developed through the adequacy process between often divergent systems, EU law has shaped the UK's data protection regime for decades. At the same time, it is essential that the adequacy findings are future proof now that the UK will no longer be bound by EU privacy rules. Therefore, once these draft decisions are adopted they would be valid for a first period of four years. After four years, it would be possible to renew the adequacy finding if the level of protection in the UK would continue to be adequate.