Will the UK get an adequacy decision post-Brexit

In a letter to the European Parliament dated 15 June 2020, Andrea Jelinek, chair, European Data Protection Board (EDPB) raises concerns over the UK’s endeavour to reach an ‘adequacy decision’ with the EU following the end of the Brexit transition period.

GDPR will remain within UK domestic law under the European Withdrawal Agreement which includes a transition period that will run until 31 December 2020.

The UK Government and EU are currently using this transition period to negotiate an agreement which may mean the UK’s 2018 Data Protection Act will be deemed ‘adequate’ by EU counterparts.

The ideal outcome for the UK would see the EU grant an ‘adequacy decision’ to the UK which would deem the UK’s data protection laws sufficiently robust to satisfy GDPR standards. The issue for the UK would be the requirement to continuously update the UK data protection laws to match any changes made by the EU.

Should this adequacy decision not be successful, the UK will be required to amend its legislation or risk non-compliance with EU law and face the penalties that come along with it.

The main issues hindering the adequacy decision are as follows:

  • The UK will not retain the EU’s Charter of Fundamental Human Rights; therefore, the protection of personal data would no longer be treated as a fundamental human right as it is in Article 8 of the Charter.
  • The UK’s Investigatory Powers Act 2016 may be deemed incompatible with GDPR.  This Act gives local national security agencies significant powers to harvest people’s information.
  • UK’s surveillance laws may not be considered to have the necessary protections to be afforded the right to privacy, i.e. the UK’s approach to accessing personal data for reasons of national security
  • The agreement made between the UK and the US on Access to Electronic Data for the Purpose of Countering Serious Crime, signed 3 October 2019.

In a letter to the European Parliament dated 15 June 2020, Andrea Jelinek, chair, European Data Protection Board (EDPB) raises concerns over the UK’s endeavour to reach an ‘adequacy decision’ with the EU following the end of the Brexit transition period.

Qualifying that the letter is an initial “preliminary analysis” Jelinek questions whether the UK was in a capacity to enter an agreement with the US as to regulating access to personal data between both countries for the purpose of preventing and prosecuting serious crime.

She explains that in light of the potential adequacy decision for the UK, “the EDPB considers that the agreement concluded between the UK and the US will have to be taken into account by the European Commission in its overall assessment of the level of protection of personal data in the UK, in particular as regards the requirement to ensure continuity of protection in case of “onward transfers” from the UK to another third country.”

Jelinek highlights that given the “EU acquis in the field of data protection, and in particular with the GDPR and the law enforcement directive” the EDPB has reservations as to whether the safeguards in the agreement for access to personal data in the UK would apply in certain circumstances requiring disclosure obligations to the US.

Changes of the UK receiving an adequacy decision further diminished when the Court of Justice of the European Union (CJEU) on July 16th gave a ruling known as the Schrems II which invalidated the Privacy Shield which was an adequacy decision it had given to the U.S because it deemed U.S. surveillance laws too intrusive for European standards.

A further CJEU ruling on the 6th October 2020, dealt a further serious blow to the prospect of digital information being able to flow freely to the U.K. post Brexit on the 1st January 2021. This new ruling deemed the U.K.’s bulk data collection regime illegal under EU law. Given the court’s ruling, the EU will find it difficult to approve the UK data protection standards without reform of the UK’s Investigatory Powers Act because it violates fundamental rights to privacy.

Based on the above, the hopes of the UK easily achieving an adequacy decision now appear more remote.