Two Executive Decisions of the European Commission

The European Commission has officially confirmed that the United Kingdom of Great Britain and Northern Ireland guarantees an adequate level of protection of personal data.

On 28 June 2021, the European Commission adopted two Executive Decisions setting out the appropriate level of personal data protection in the UK:

  • The first with the reference number C (2021) 4800 finalIssued on the basis of Regulation (EU) 2016/679 (GDPR);
  • The second is a reference number C (2021) 4801 final, issued under Directive (EU) 2016/680.

Effects of European Commission Executive Decisions on Transfer of Data to the United Kingdom

Recognition by the European Commission of a specific third country, in this case Great Britain, that ensuring an adequate level of personal data protection allows free transfer of such data from the European Economic Area (27 EU Member States, Iceland, Liechtenstein and Norway) without the need to obtain additional permits or Implementation of additional safeguards provided for in Chapter V of the General Data Protection Regulation, which are required if the third country does not provide such protection.

Similarly, data transfers to the United Kingdom will be evaluated on the basis of the provisions of Chapter 3A of the 16 September 2011 Law on Information Exchange with Law Enforcement Authorities of EU Member States, Third Countries, EU Agencies and International Organizations, which is implemented in the Polish legal system of During Chapter V of the Directive (EU) 2016/680.

The ability to freely transfer data to the UK does not preclude compliance with other data protection laws.

See also  Joe Biden wins "Blue Wall" state

The period of validity of the executive decisions of the European Commission

Both resolutions entered into force on June 28, 2021 and were passed for a fixed period of four years. This means that it will apply until June 27, 2025. If during that time the UK continues to ensure an adequate level of personal data protection, the European Commission may extend the validity of these decisions.

Scope Limits of Application of Final Executive Resolution C (2021) 4800 under the General Data Protection Regulation (GDPR)

Transfer of data for UK immigration control purposes is excluded from the subject matter scope of the final KEC (2021) 4800 Implementation Decision, due to the limited application of UK data protection law in this respect.

Providing personal data prior to the issuance of European Commission executive decisions

According to the so-called traffic condition contained in the final provisions Trade and Cooperation Agreements between the European Union and the European Atomic Energy Community on the one hand and the United Kingdom of Great Britain and Northern Ireland on the other من, which governs the current relationship between the European Union and the United Kingdom from 1 January to 30 June 2021, the transfer of data from the European Economic Area to the United Kingdom has not been treated as a transfer of data to third countries.

Actions required of controllers in connection with the transfer of personal data to the United Kingdom

Since the transfer of personal data to the United Kingdom implies the transfer of personal data to a third country, the controllers of such a situation in particular must adjust the applicable information items and documents for the processing of personal data accordingly.

See also  US Ambassador Mark Brzezinski: Polish-American relations are multidimensional