European Commission expected to approve UK-EU data transfers

The adequacy assessment has huge significance for businesses operating across the UK and the EU. It has attracted especially great interest due to the striking down of two consecutive EU-US data transfer agreements by the Court of Justice of the European Union (CJEU).

Data transfers between the UK and the EU are currently governed by an interim data agreement which expires at the end of June 2021. This was established during the Brexit process to provide enough time for the adequacy assessment to take place.

The Financial Times reports that it has seen a draft adequacy decision which is expected to be approved by the European Commission this week. It will then be scrutinised by the European Data Protection Board, which does not have veto powers.

However, the arrangement would be reviewed every four years and could also be subject to litigation, as has happened with the EU-US agreements.

Dr Julie Nixon, senior associate at Morton Fraser, said: “British businesses must remember this decision is not yet final, so any celebration could be premature. There is still a temporary four-to-six-month bridge period during which time certain requirements, such as the approval from representatives of all EU member states, must be met.

“During this period, personal data can continue to flow from the EU to the UK. But it’s recommended that UK businesses transferring personal data with EU and EEA organisations should put alternative transfer mechanisms in place, such as standard contractual clauses, to safeguard against any interruption to personal data flows in case an adequacy decision is not officially adopted by the end of the bridge period.”