Yesterday, the European Data Protection Board (EDPB) published its opinion on the European Commission’s draft Decision that the UK ensures an adequate level of protection for personal data (the Opinion). The Opinion was adopted by the EDPB on 13 April 2021, a couple of days before the Opinion’s official publication on 15 April 2021.
The EDPB recognises that the UK’s adequacy assessment is unique given it was an EU Member State until very recently and therefore acknowledges there are many areas of convergence between the UK and EU regimes. However, much of the Opinion examines a number of “challenges” with the UK regime. The EDPB recommends that the European Commission addresses and monitors these concerns over time. In particular, the Opinion focuses on:
- the immigration exemption which some believe restricts data subject rights. Indeed, the immigration exemption is currently being challenged in the UK courts following a challenge by the Open Rights Group;
- how onward transfers of EEA personal data transferred to the UK, on the basis of, for instance, future adequacy decisions adopted by the UK could undermine EU data protection rules. John Whittingdale who is the United Kingdom’s Minister of State for Media and Data recently wrote that the UK “will champion the international flow of data” and “will make the case for removing unnecessary barriers to data flows, where the significant benefits of growth and innovation are put at risk by more protectionist forces”. He said that the UK will aim to “expand the list of adequate destinations” for personal data.
In relation to access to personal data by public authorities (which is arguably one of the most contentious topics in data protection at the moment), the Investigatory Powers Act 2016 and related case law are analysed extensively in the Opinion. The EDPB welcomes the numerous oversight and redress mechanisms in the UK, but identifies a number of points requiring “further clarifications and/or monitoring”, including in relation to bulk interceptions.
Whilst the tone of the non-binding Opinion may be cautious, it remains to be seen how much influence it will have when the Decision is voted on by Member States. Reports suggest that the Commission has been very critical of the EDPB’s approach to the Decision, expressing concerns that it is setting an impossible standard.
Our take
There is clearly political will to grant the UK an adequacy finding and it would be surprising if the forthcoming vote is not favourable, particularly since the Opinion does not seem to attempt to block the UK’s adequacy finding.
However, one cannot ignore that the Opinion highlights in no uncertain terms what it considers to be deficiencies in the UK national security surveillance regime. This could help privacy activists build arguments as to why the UK adequacy decision (and other adequacy decisions) ought to be challenged and struck down. So whilst organisations may be able to breathe a sigh of relief for now, this may not be the end of the UK adequacy saga.
