Personal data can flow freely from the European Union to the United Kingdom

At the same time, the Commission has carefully noted the concerns raised by Parliament, Member States and the European Data Protection Council, including possible future deviations from our standards within the UK data protection framework. “This is a fundamental right of EU citizens that we have to protect. That is why we have put in place extensive guarantees and if the situation on the British side changes, we will act immediately.”

Didier Reynders, EU Commissioner for Justice, added: “After months of careful scrutiny, today we can reassure EU citizens that their personal data will be protected when transferred to the UK. This is an integral part of our new relationship with the UK. It is important for smooth trade and the struggle Effective against crime The Commission will closely monitor how the UK system evolves in the future In order to make this possible and to be able to intervene if necessary we have strengthened our decisions The European Union has the highest standards of personal data protection and should not be compromised when personal data is transferred abroad “.

The adequacy decisions also facilitate the proper implementation of the EU-UK Trade and Cooperation Agreement, which provides for the exchange of personal data (eg in the context of judicial cooperation). Data transfers for immigration control exercised by the UK are excluded from the material scope of the adequacy determination approved under the General Data Protection Regulation (GDPR).

Key elements of adequacy decisionsقرار

• The UK’s data protection regime is still based on the same rules that applied when the UK was still a member of the European Union. The UK has fully incorporated the principles, rights and obligations of the GDPR and the Data Protection Directive in law enforcement into its current legal system, which has been in place since Brexit.
• The UK system has strong safeguards regarding UK authorities’ access to personal data (particularly for reasons of national security). In particular, data collection by intelligence services is subject to prior approval by an independent legal body. All measures must be necessary and proportionate to the objective pursued. Anyone subjected to illegal surveillance measures can file a complaint with Investigative Powers Court (The Court of Investigation Powers). The UK is also subject to case law European Court of Human Rights , The European Convention on Human Rights and the Council of Europe Convention on the Protection of Individuals with regard to the Automatic Processing of Personal Data , the only binding international agreement in the field of data protection. These obligations under international law are an essential part of the legal framework assessed in my adequacy decisions.
• For the first time, resolutions of suitability contain a termination clause, which strictly limits their validity: both decisions expire four years after their entry into force. It can then be renewed if the UK continues to ensure an adequate level of data protection. During these four years, the Commission will continue to monitor the legal situation in the UK and will be able to intervene at any time if the UK deviates from the current level of data protection. If the committee decides to renew suitability decisions, the accreditation process will be resumed.
• UK Immigration Control data transfers are excluded from the material scope of the GDPR adequacy decision to reflect the recent decision of the Court of Appeal in England and Wales regarding the validity and interpretation of certain limitations on data protection rights in this area. Once this situation has been resolved under UK law, the Commission will reconsider the need for this exclusion.

my knowledge

The Commission published two draft resolutions on adequacy on February 19 and began the process of their adoption. Over the past few months, the Commission has carried out a comprehensive assessment of UK legislation and practice in the protection of personal data, including the rules on UK authorities’ access to data. The Commission has been in close contact with the European Data Protection Council, which issued its opinion on April 13, the European Parliament and member states. After this thorough examination, the European Commission obtained the approval of the representatives of the Member States for my adequacy decisions as part of the so-called commission procedure. The adoption of resolutions today, with the approval of representatives of Member States, was the last step in this process. My decision of fitness goes into effect today.

The Trade and Cooperation Agreement between the European Union and the United Kingdom contains a commitment by the European Union and the United Kingdom to maintain high standards of data protection. The agreement also states that any data transmission carried out while it is being carried out must be in accordance with the relevant data protection regulations of the contracting party to the carrier (in the case of the European Union, this is the General Data Protection Regulation and the Directive on Data Protection in Law Enforcement). The adoption of the unilateral and independent adequacy decisions is an important measure to ensure the proper application and smooth operation of the Agreement. The EU-UK Trade and Cooperation Agreement also provides for a conditional transitional arrangement under which data can be transferred from the EU to the UK without hindrance. The transition period ends on June 30, 2021.

Additional information:

The full press release

Adequacy of decisions and related documentsستند

European Commission opens procedures for transfer of personal data to the UK (February 2021)

The international dimension of data protection: adequacy decisions

Press contact: Catherine Appel, Phone: +49 (30) 2280-2140

The team at the ERLEBNIS EUROPA Visitor Center answers citizens’ questions by email or phone at (030) 2280 2900.