The Government says that the UK has “a world-class data protection system” which is currently the same as the European Union’s, so it is “logical that the Commission should find the UK ‘adequate’” (see item above). The Government notes that the EU already recognises other countries around the world as adequate, including Argentina, Canada, Israel, Japan, New Zealand, Switzerland and Uruguay, and the UK freely exchanges data with these countries.

Positive data adequacy decisions under both the General Data Protection Regulation (2016/679/EU) and the Law Enforcement Directive (2016/680/EU) would allow for personal data to continue to flow freely from the EU and wider European Economic Area (EEA) to the UK.

The Government says that seamless international data flows are essential in a hyper-connected world. They underpin the exchange of information and ideas supporting trade, innovation and investment, assist with law enforcement agencies tackling crime, and support the delivery of critical public services sharing personal data as well as facilitating health and scientific research. Technical confirmation of the draft adequacy decisions will help make sure UK businesses and organisations in everything from logistics to legal services, healthcare to human resources, can continue to receive personal data from the EU and EEA without additional compliance costs. This ensures they will avoid potential knock-on effects for consumers and boost UK start-ups and smaller firms which operate in EU markets and sell to EU customers.

The UK formally provided the Commission with comprehensive explanatory material nearly a year ago at the start of the adequacy assessment in March 2020. The UK has already recognised the EU and EEA Member States as “adequate”, as part of its commitment to establish a smooth transition for the UK’s departure from the bloc and manage data flows on an objective basis.

Since then, UK officials led by the DCMS have held a series of discussions with their European Commission counterparts to reiterate carefully and fully the UK’s legal and regulatory framework and demonstrate beyond doubt that the UK clearly meets the EU’s data adequacy requirements.

The draft decisions published by the Commission will now be shared with the European Data Protection Board for a non-binding opinion, before being presented to EU Member States for formal approval.

The Government says that the UK made its representations to the EU in a timely manner, but the Commission “did not finalise draft decisions in time to complete the adoption process by the end of the transition period”. For this reason, as part of the UK/EU Trade and Cooperation Agreement, a time-limited bridging mechanism for personal data flows was agreed. This currently allows personal data to continue to flow as it did before the end of the Brexit transition period for up to six months, while the EU completes the adequacy process.

The UK Government now urges the EU to swiftly complete this technical process for adopting and formalising these adequacy decisions as early as possible. To read the Government’s announcement in full, click here.