EDPB Adopts Two Opinions on the Draft UK Adequacy Decisions

Written by: Brett Lawrence, Esq.

On April 14, 2021, the European Data Protection Board (“EDPB”) announced it had adopted two opinions in support of the draft UK adequacy decisions. The opinions stem from the EDPB’s review of the European Commission’s draft adequacy decisions for the General Data Protection Regulation (“GDPR”) and the Law Enforcement Directive (“LED”). The GDPR draft adequacy decision concerned the UK’s general data protection framework, while the LED draft adequacy decision discussed the UK’s standards for personal data usage for law enforcement purposes.

The EDPB noted “there are key areas of strong alignment between the EU and the UK data protection frameworks on certain core provisions,” including (1) lawful processing for legitimate purposes, (2) data retention, (3) security and confidentiality, and (4) automated decision making and profiling. Because the UK adopted GDPR and LED following its leave from the EU, the EDPB understood that the “UK data protection framework is largely based on the EU data protection framework” and that “the UK has mirrored, for the most part, the GDPR and LED.”

However, while the EDPB took into account the UK’s adoption of the EU framework, the EDPB underlined several items for close monitorization, such as:

1. 1. The Immigration Exemption: The UK’s Data Protection Act exempts from GDPR data controllers involved in “immigration control.”
   2. Onward Transfers: The application of restrictions on transfers of personal data beyond the UK. These onward transfers to third countries on the basis of future adequacy decisions adopted by the UK may not be recognized as adequate under GDPR.
   3. Public Authority Access: The EDPB discussed extensively the need for overseeing public authority access to personal data transferred to the UK for national security reasons.

Following the opinions, the European Commission may amend the draft adequacy decisions to address the EDPB’s concerns or present them for review by each EU member state.

Click here to read the GDPR opinion.

Click here to read the LED opinion.