The European Data Protection Board issues opinions on the draft UK adequacy decisions

Following a plenary session held on 13 April 2021, the European Data Protection Board (EDPB) has issued opinions on the draft UK adequacy decisions released by the European Commission in relation to data transfers under the UK GDPR and the Law Enforcement Directive (LED).

Summary

In summary, the EDPB took a mainly positive stance on the UK’s data protection law and practice system on the basis that it is largely based on the EU data protection framework, noting both systems alignment on key provisions that are essential for establishing equivalence.

Concerns

Although mostly reassuring, the EDPB’s opinions did raise concerns that the UK system may depart from the EU system over the course of time and recommended that the European Commission place time limits on its adequacy decisions to closely monitor or further assess its development in due course.  The main areas of the EDPB’s concerns were:

1. The consequences of the immigration exception on data subject rights
2. Transfers of EEA personal data to the UK (known as onward transfers) under derogations, future adequacy decisions adopted by the UK, or international agreements between the UK and third countries
3. The UK surveillance regime, in particular, the challenges of reparation in relation to national security, bulk interceptions, automated processing and safeguards for overseas disclosure

Since the plenary session, the EDPB Chair, Andrea Jelinek, has spoken at the European Parliament’s LIBE Committee; reiterating the EDPB’s areas of concern, and asking the European Commission to assess the immigration exception situation more closely and, if appropriate, update the adequacy decision.

The immigration exception

The immigration exception is found in part 1, paragraph 4 of Schedule 2 to the Data Protection Act 2018.  It serves to disapply certain rights of data subjects where their personal data is not originally collected for the purpose of immigration control by the controller, but is shared by that controller with another controller who then processes it for the purpose of immigration control.

Some believe that the immigration exception is too broad and has the effect of restricting the rights of data subjects.  The Open Rights Group challenged the lawfulness of the immigration exemption in 2019 on the following grounds:

1. It being incompatible with the rights guaranteed by Articles 7 and 8 of the UK GDPR relating to the conditions for consent of adult and child data subjects to the processing of their personal data
2. It being contrary to Article 23 of the UK GDPR, which gives data subjects the right to be informed about a restriction to their right to information

Although the High Court decided in favour of the immigration exemption’s lawfulness, the EDPB has asked the European Commission to further consider the necessity and proportionality of the immigration exemption in UK law.

Next steps

Taking into account the EDPB’s opinions, the European Commission will seek approval of the draft UK adequacy decisions from representatives of each EU Member State.  Once approval has been given by each EU Member State, the European Commission will then be in a position to adopt a final adequacy decision.

In line with the European Commission’s recommendation to place time limits on its adequacy decisions, the final adequacy decision would be valid for four years.  After this period, the European Commission will reassess the UK’s data protection regime and make another decision as to its continued adequacy.

Need a data specialist lawyer?

For more information, help or advice, contact Sophie Robertson on [email protected] or 0191 211 7972.