The Digital Policy Promotion Department of the Prime Minister’s Chancellery reports:

On Monday, the European Commission adopted a resolution declaring the appropriate level of protection for personal data in the UK. Effect? Transfer of data from the European Union to this country does not require any additional authorization.

The United Kingdom left the structures of the European Union on January 31, 2020. After several months of work, the European Commission on Monday (June 28) adopted an Executive Decision based on Regulation (EU) 2016/679 of the European Union Parliament and Council (GDPR), illustrating the appropriate level The protection of personal data by the United Kingdom. See information from the European Commission on this issue and the text of the resolution.

Without additional permission

The European Commission has exercised its authority under Article. 45 seconds. 3 General Data Protection Regulation, under which it may – by way of implementing law – adopt a resolution that a third country, territory, or specific sectors or sectors of that third country or international organization ensure an adequate level of protection. Adoption of such a resolution allows data to be transferred to that country without the need to obtain any additional license.

In order to pass an adequacy decision for the UK, the European Commission had to conduct a thorough analysis of that country’s legal system. The analysis covered provisions on data subject rights, limitations and safeguards for public authorities’ access to personal data, as well as safeguards ensuring a level of protection “substantially equivalent” to that provided in the European Union.

The decision of suitability for the UK came at the right time. Only until June 30 this year, the so-called fixed period, negotiated by the European Union and the United Kingdom, during which the transfer of personal data from the European Union to the United Kingdom was not considered a transfer to a third country. We wrote about it.

under control

Adoption of the UK Adequacy Decision by the European Commission before the end of the so-called fixed period allows those involved in the transfer of personal data between the EU and Great Britain to make transfers based on this legal instrument.

The UK suitability decision includes a mechanism known as a lapse clause, which has not been used in this type of legal instrument so far. It was adopted for a fixed period of time – ending on June 27, 2025. It is possible that the period of its application will be extended. This solution is to enable the European Commission to monitor on an ongoing basis the actual and legal framework on which the adequacy decision depends.

Currently, the decision of suitability does not cover data transfers for the purposes of UK immigration control, which is the result of a UK national court ruling on the interpretation of restrictions on data protection rights in this area. This exception will be verified on an ongoing basis by the European Commission on the basis of the UK’s planned legal solutions in this regard.

On Monday, the European Commission also adopted an Executive Decision under Directive (EU) 2016/680 of the European Parliament and Council, declaring the appropriate level of personal data protection in the UK.

Note: Messages are posted on the PAP website without PAP SA making any changes to their content, in the form provided by the sender. The sender of the message is responsible for its content – subject to the provisions of Art. 42 seconds 2 of the Press Code (PAP)

com/wkr/