The European Commission has proposed to issue the UK with ‘data adequacy’ decisions to facilitate the continued free flow of personal data from EU Member States to the UK.

The draft decisions of the Commission still need to be formally approved by representatives of EU Member State governments.

Two adequacy decisions for transfers of personal data from the EU to the UK would need to be adopted to enable data to flow as it did before Brexit, one under the General Data Protection Regulation and the other under the Law Enforcement Directive.

Before going forward for approval by a committee composed of representatives of the EU Member States, the Commission’s draft adequacy decisions will be scrutinised by data protection authorities from across the trading bloc through the European Data Protection Board (EDPB). However, the opinion of the EDPB in respect of data adequacy decisions is not binding on the Commission.

Under current terms, the UK will have to undergo a reassessment of its data protection rules within four years or else risk losing its status as a safe destination for EU data.

More information is available in the formal statement from the European Commission.