New law: Businesses likely to be able to carry on moving personal data freely between the UK and the EEA

The EEA comprises all EU member states, plus Norway, Iceland and Liechtenstein.

An EU adequacy decision is a formal recognition by the EU that a non-EU country – in this case, the UK – already has adequate data protection law that protects the privacy of individuals’ personal data to the EU’s satisfaction. It means that additional steps to protect such personal data – such as requiring that every legal agreement under which personal data is to be moved between the UK and EEA contains special protective clauses, known as Model or Standard Contractual Clauses – do not have to be taken by the businesses concerned.

The EU has to make a full adequacy decision in relation to the UK by 30 June 2021, when an agreed grace period, during which data can continue to be moved without an adequacy decision, runs out. The process requires that the European Data Protection Board review the draft and make recommendations, which are then taken into account. Final sign-off is given by a committee made up of representatives from each EU member state. Then, every four years, the Commission chooses whether to review its decision.

The UK has already recognised the adequacy of EU laws for these purposes.

Operative date

• Now

Recommendation

• UK businesses whose operations require them to move personal data between the UK and the European Economic Area (EEA) can more confidently assume that they may continue to do so from 1 July, whilst remaining alert to the possibility that the European Commission’s adequacy decision may not be signed off.