EU-UK data ‘adequacy’ decisions to get six months extension

The Commission has proposed to extend the effect of its two so-called ‘adequacy’ decisions relating to the UK, which provide for the free flow of personal data between EU countries and the UK, until 27 December 2025.

EU adequacy decisions are decisions that recognise that the data protection frameworks in operation in other territories are ‘essentially equivalent’ to those in place in the EU. The effect of those decisions is to provide organisations in the EU with a blanket basis on which to transfer personal data to those other territories in line with EU data protection law. The EU-UK adequacy decisions, issued in June 2021, enable compliant personal data transfers under the EU General Data Protection Regulation (GDPR) and the EU’s Law Enforcement Directive, respectively.

Without the adequacy decisions being in place, organisations wishing to transfer personal data from the EU to the UK would face much greater compliance costs, owing to the significant restrictions imposed on the international transfer of personal data under EU data protection law. 

The EU-UK adequacy decisions are currently due to expire on 27 June 2025. The Commission must assess afresh whether the UK’s data protection regime continues to meet the standards required for new adequacy decisions to be issued. However, that assessment has been complicated since the UK is currently in the process of updating its data protection legislation.

The Data (Use and Access) Bill (DUAB) was introduced into the UK parliament last autumn. It has since progressed through the House of Lords and is currently at the committee report stage in the House of Commons.

While much of the debate over the contents of the DUAB has so far centred on whether AI-related copyright protections should be built into the Bill or not, a core purpose of the DUAB is to better enable data-related innovation and efficiencies in the UK economy, in line with the government’s growth mission. Reforms are envisaged to the existing data protection framework in the UK, which has its origins in EU law. Changes planned include to data subjects’ rights and to rules relevant to the use of AI – including around automated decision-making and the processing of personal data for scientific research purposes.

As Malcolm Dowden of Pinsent Masons highlighted earlier this year, while there is some scope for UK law makers to make changes to the EU-derived data protection regime that is currently in place in the UK, they must be careful not to diverge too far to avoid the UK losing its adequacy status.

The Commission’s proposed extension of the existing EU-UK adequacy decisions is designed to give more time for UK law makers to finalise the DUAB and, in turn, for it to undertake its adequacy assessment.

Data protection law expert Jonathan Kirsop of Pinsent Masons said: “The decision to extend gives some welcome breathing space for DUAB to be finalised and the impact of the proposed amendments to the current terms of the UK GDPR to be assessed. Areas such as the slightly lessened restrictions on automated decision making are likely to be considered by the Commission in assessing the continued adequacy of the UK landscape post the passing of the Bill but the hope and expectation of the UK government is that divergence with the EU GDPR will remain sufficiently limited to allow for continued adequacy to be granted to the UK. In my view, there is reason for such optimism.”

EU commissioner for democracy, justice, the rule of law, and consumer protection, Michael McGrath, said: “The adequacy decisions are key to our relationship with the UK. They ensure data can flow freely and safely, which is crucial for trade, justice, and law enforcement cooperation. Our proposal will allow the Commission to assess whether to renew these decisions based on a stable legal framework, while keeping data flows to the UK uninterrupted.”

The Commission said its proposed extension decisions will be considered by data protection authorities in the EU via the European Data Protection Board (EDPB) before they are adopted.

It added: “Once the UK's legislative process … concludes, the Commission will assess whether the UK continues to provide an adequate level of protection for personal data. If that assessment is positive, the Commission will propose to renew the UK adequacy decisions.”