As had been trailed for a couple of days, on 19 February 2021, the European Commission formally announced that it had launched the procedure for the adoption of two adequacy decisions for transfers of personal data to the United Kingdom, under the GDPR and the Law Enforcement Directive. The draft decisions have been published here. The draft decisions will be considered by the European Data Protection Board, and then a committee of Member State representatives. The European Parliament has plays an active role in scrutinising the Commission’s approach and, of course, any decision adopted can (and doubtless will) be the subject of legal challenge, ultimately before the CJEU. There is some way to go yet, but at this first stage the Commission has accepted the general proposition that as the UK has retained EU data protection law, it provides in principle an adequate level of protection (albeit over 88 and 51 pages respectively). Much food for thought.

Christopher Knight