The approval by the EU executive came just a few days before the adoption of an interim decision to continue data transmission over the channel after the end of Brexit.
The adequacy decision, as the data flow deal is called, will allow the transfer of personal data from the EU to the UK, avoiding a no-deal scenario that could have cost the British economy £1.6 billion.
UK Secretary of State for Digital, Oliver Dowden, said that the formal recognition by the European Union of the UK's high standards of data protection is right. He added that this is welcome news to business, it also supports cooperation between the UK and the EU and will help law enforcement authorities to ensure the safety of people.
The EU's decision requires that both sides renegotiate the agreement within four years. It means that the EU can pull the deal if the UK diverges too much from the EU's privacy rules. That could have a significant impact on the UK since three-quarters of its international data flow is coming from the EU. London has said it wants to review its privacy standards to get more economic benefits from data.
“After months of careful assessments, today we can give EU citizens certainty that their personal data will be protected when it is transferred to the UK. This is an essential component of our new relationship with the UK. It is important for smooth trade and the effective fight against crime," EU justice chief Didier Reynders said in a statement.
Despite the announcement, the decision has faced heavy criticism from European lawmakers, regulators, and privacy activists, who argue that the UK's surveillance rules and exemptions for immigrants deserve further scrutiny from Brussels. Responding to concerns, Commission vice-president Věra Jourová said that Brussels had provided precautionary measures that will allow it to intervene if the UK diverges too far from EU data protection standards.
The approval completed a complex process. The European Commission ran out of time to approve the deal before the Brexit transition period ended in January 2021, so it was necessary to develop a temporary six-month solution as part of the trade deal to continue the data transfer.
Since then, the EU's decision to approve the data regime in the UK, first proposed in February 2021, has been heavily criticized by the European network of privacy regulators, the EDPB, as well as MEPs who recently called on the European Commission to postpone the approval of data standards in the UK.
Their criticism is based on the British government's plan to diverge from EU data protection standards, which is a prerequisite for getting the deal, as well as on court decisions in Europe and London that have questioned the legality of British privacy standards and the country's surveillance regime.
UK adequacy is likely to come under scrutiny in the coming months and years. Several campaigners are preparing legal actions against this decision, inspired by judicial precedents regarding similar data flow deals in the United States.
The news piece has been based on the article "EU approves UK data flows deal" by Vincent Manancourt. If you find our articles interesting, you can subscribe here; we will be pleased to get feedback.