The granting of an adequacy decision means that the personal data of EU/EEA data subjects can now be transferred from the EU/EEA to the UK without any further procedures in place such as Standard Contract Clauses(SCCs) or Binding Corporate Rules (BCRs).
However, there are some caveats. For example, a ‘sunset’ clause means the decision will be reviewed in four years’ time. The EU also reserves the right to monitor the UK’s data protection regime to ensure it continues to offer EU/EEA data subjects an equivalent level of protection.
“Although from a UK perspective, the granting of an adequacy decision was a formality – after all, the UK GDPR is essentially the EU GDPR – there were some in Brussels who had reservations. But as this decision will save UK businesses time and money, it is very welcome, even with the caveats,” commented Jane Berney, ICAEW Technical Manager for Business Law.
Why is an adequacy decision a good thing?
The EU now classifies the UK as a ‘third country’. As far as data protection is concerned, this means that transfers of personal data from the EU/EEA to a third country are not allowed unless the EU is satisfied that EU/EEA data subjects have the same rights and protections in the third country. An ‘adequacy decision’ is proof of this. Without an adequacy decision, alternative mechanisms such as SCCs need to be in place with the attendant cost and administrative burden.
What should I do now?
The adequacy decision means the transfers of personal data between the EU/EEA and the UK can continue freely but for transfers of personal data to and from other countries, you need to make sure you comply with the current rules on international transfers.
Further reading
- ICAEW resources: data protection and privacy
- ICAEW’s Brexit hub
- ICO Guide to International transfers