EU renews post-Brexit data decision
The European Commission has renewed two decisions that provide organisations based in the EU with a legal basis for transferring personal data to Britain.
EU law allows the transfer of personal data outside the European Economic Area (EEA) only if such a third country is considered to have laws essentially equivalent to those that safeguard personal data inside the EEA.
The commission today (19 December) announced extensions of the validity of Britain’s adequacy decisions under the GDPR and the Law Enforcement Directive (LED) for six years when they expire at the end of this year.
The renewals follow approval from member states and an opinion from the European Data Protection Board (EDPB).
The new decisions run until 27 December 2031, with the possibility of renewal. The commission and representatives of the EDPB will review the functioning of the adequacy decisions after four years.
‘Strategic partner’
Justice commissioner Michael McGrath described Britain as “an important strategic partner” for the EU, adding that the adequacy decisions formed a “central pillar” of the partnership.
“By enabling the free flow of personal data, they underpin both commercial exchanges and co-operation in the fields of justice and law enforcement,” he stated.
McGrath said that the renewals reflected the commission’s assessment that Britain’s legal framework continued to provide robust safeguards for personal data that remained closely aligned with EU standards.