European Union – Commission Decisions on United Kingdom
The European Union Commission has passed the following two Implementing Decisions on the 28th June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom and Directive (EU) 2016/680, on Law Enforcement on the adequate protection of personal data by the United Kingdom.
The enforcement of the Implementing Decisions means that the continuation of free movement and flow of personal data between the European Union and the United Kingdom is safeguarded, as the Commission has deemed the United Kingdom to offer and enjoy an equivalent level of protection under the requirements of EU Law. As such, businesses and persons operating in the United Kingdom can now from unrestricted personal data transfer within the European Union, subject to the GDPR regulations being followed.
The key essence of the Implementing Decisions is as follows:
- For the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for the personal data transferred within the scope of Regulation (EU) 2016/679 from the European Union to the United Kingdom.
- The United Kingdom ensures an adequate level of protection within the meaning of Article 36(2) of Directive (EU) 2016/680, interpreted in view of the Charter of Fundamental Rights based on both the relevant United Kingdom domestic regime and its international commitments, in particular adherence to the European Convention of Human Rights and, submission to the jurisdiction of the European Court of Human Rights. Continued adherence to such international obligations is therefore a particularly important element of the assessment on which this Decision is based.
It should be noted that the Commission makes allowances for the end of the transition period provided by the Withdrawal Agreement and as soon as the interim provision under Article 782 of the EU-UK Trade and Cooperation Agreement will cease to apply, the United Kingdom will administer, apply and enforce a new data protection regime, comparable to the one in place when it was bound by EU law. This may notably involve amendments or changes to the data protection framework assessed in the Decisions, as well as other relevant developments.
It is therefore appropriate to emphasize that both Decisions will apply for a period of four years as of their entry into force.
For any further guidance regarding this procedure or if you require an initial consultation, please do not hesitate to contact our Law Firm at [email protected], +357 22 251 777 or +357 25 261 777 or please visit our office in Nicosia or Limassol.