A positive step towards data adequacy status was reached in February with the publication of the European Commission’s draft adequacy decision.
After nine months of assessing the UK’s domestic law and practice on personal data protection, the Commission determined that the UK does ensure essentially equivalent personal data protection to that provided under the General Data Protection Regulation (GDPR). This decision, if implemented, would allow for the free flow of personal data from the EU into the UK to continue past 30 June 2021, when the ‘adequacy’ bridge agreed in the 2020 Trade and Cooperation Agreement is set to expire.
The next stage is for the European Data Protection Board to provide a non-binding opinion, and after taking the opinion into account, the Commission will then send the draft decision to EU Member States for formal approval: the European Commission may then adopt the decision.
How long will this process take? In 2019, the EU adopted its adequacy decision on Japan just four months after publicising its draft decision. Given the UK’s GDPR is based on the EU’s GDPR, UK businesses can take news of this draft adequacy decision as hopeful progress.