Data transfer from the European Union to the United Kingdom

On 19th February 2021, the European Commission initiated the process to pass two adequacy decisions for transfers of personal data to the United Kingdom, under the General Data Protection Regulation and the Law Enforcement Directive on data transfers to the United Kingdom. The passing of both decisions “on adequate data protection” includes an opinion from the European Data Protection Board and approval of the committee that consists of the representatives of the EU Member States in the European Council.

On 28th June 2021, the European Commission passed “Decision on the adequate protection of personal data by the United Kingdom – General Data Protection Regulation” and “Decision on the adequate protection of personal data by the United Kingdom: Law Enforcement Directive” on data transfers to the United Kingdom. The decisions on adequate data protection improve the proper implementation of the Trade and Cooperation Agreement signed between the European Union and the United Kingdom that stipulates the exchange of personal data, for example, for cooperation in court cases, the provision of services between the European Union and United Kingdom, etc.

After the passing of the above decisions, the data protection system of the United Kingdom is still based on the same rules and regulations that were effective when the United Kingdom was a Member State of the European Union. Since Brexit, the United Kingdom has completely included the necessary principles, rights and obligations of the General Data Protection Regulation and the Law Enforcement Directive in its legal system.

Both decisions are in force for four years, starting as of the day of passing, i.e., until 28th June 2025.