The protection of personal data in the United Kingdom (UK) is good even after the Brexit, but there are also concerns. This is what European privacy regulators are writing to the European Commission (EC). They are responding to European plans to allow the transfer of personal data to the UK again.
In so-called adequacy decisions, the EC establishes that personal data is adequately protected in the UK. And so there is no objection to transferring personal data from the EU to the UK.
Privacy regulators, united in the European Data Protection Board (EDPB), published 2 opinions to the EC on April 13 in response to 2 proposed adequacy decisions.
The UK finally left the European Union on December 31, 2020. As a result, the UK is now no longer bound by 2 European privacy laws, the General Data Protection Regulation (GDPR) and the Police and Justice Directive.
European companies are therefore not allowed to transfer personal data of European citizens to companies in the UK without further ado. With the 2 adequacy decisions that the EC is now proposing, one for the AVG and one for the Police and Justice Directive, that should become possible again.
In the 2 opinions, the EDPB indicates that the data protection system in the UK is very similar to the European system. This is not surprising, either. After all, the Brexit is only a few months away and the UK has "copied" both the AVG and the Police and Justice Directive into its own legislation.
Nevertheless, the EDPB also expresses a number of concerns. Especially about the possibility that personal data will soon be transferred - via the UK - to other countries, where personal data are insufficiently protected. Such as the United States.
The EDPB asks the EC for clarification on those points. And to monitor this closely in the future.
The EC's assessment is valid for 4 years. After that, it will consider whether the level of protection is still appropriate. But the EC cannot intervene in the interim if, in the meantime, the UK takes measures that effectively lower the level of protection.
The EDPB also paid attention to this in its opinions. The EDPB also asks the EC - where necessary - to make interim adjustments.
The EC is required to seek EDPB advice on adequacy decisions. But the EC is not obliged to follow all advice.
It is not yet known when the EC will decide whether the adequacy decisions will be adopted. And thus whether European companies will be allowed to transfer personal data to companies in the UK.
