This is great news for the UK because the adequacy decision helps to ensure seamless trade between the UK and the EU. It allows personal data to be sent from an EU/EEA state to a third country (in this case the UK) without the need for any further safeguards.
The adequacy decision is expected to stay in place until June 2025. But, the EU can amend, suspend, or repeal the decision if they believe there are issues with the level of protection that the UK gives to personal data.
There have been concerns in the past about the mass surveillance practices carried out by the UK. The ECJ has found the UK's Investigatory Powers Act to be unlawful due to general and indiscriminate retention of electronic communications.
In similar circumstances the European Court of Justice invalidated the EU-US Privacy Shield decision. This had been the framework under which the EU and the US exchanged personal data.
Another potential concern is that - rather than simply ensuring data protection standards for UK and EU citizens - the adequacy decision could be used as a political bargaining tool.
What your organisation could do to protect itself:
· Create a practical ‘plan B’ for the compliant transfer of personal data between the UK and the EU. This will give you back up in the event of any unexpected disruptions.
· Ensure that all your contracts with partners and clients contain clauses that allow you to use alternative means of transferring data if the need arises.
Find out how we can support you.
At PEO Legal, we provide legal and compliance advice for professional employer organisations and staffing companies around the world. If you want support with your contracts, or any other point of cross-border employment law, contact us, today.
*Other countries that have previously received an adequacy decision: Andorra, Argentina, Canada (commercial organisations only), Faroe Islands, Guernsey, Isle of Man, Israel, Japan (private-sector organisations only), Jersey, New Zealand, Switzerland and Uruguay.