Adequacy for the UK - are we really out of the woods?

The European Commission has announced that it has started the procedure for an Adequacy Decision to be made for the United Kingdom, in relation to both the GDPR and the Law Enforcement Directive. 

Whilst this will be a relief to many, it does not necessarily mean that data transfers from the EU to the UK will be all plain sailing from here. We've seen the determination of Max Schrems and NOYB in bringing down various transfer mechanisms between the EU and the US, with arguments centred mainly around US surveillance laws. In the wake of Brexit and the resulting lack of UK binding to EU privacy laws, there are likely to be many parties with their eye on the future of UK legislation. Similar challenges to those brought against the Safe Harbour and Privacy Shield regimes may appear. 

The European Commission itself has acknowledged the potential implications of Brexit in its announcement, stating that the initial Adequacy Decision will be valid for a period of four years, after which it will be reviewed again, to make sure the UK's data protection landscape is still considered adequate after a period out of the Union. 

In the meantime there are still a couple of hurdles to meet - the opinion of the European Data Protection Board and a vote from Member States' representatives will now be sought. Thankfully we have the interim data transfer regime in place to protect data transfers from the EU to the UK during this process, in the shape of the EU-UK Trade and Co-operation Agreement. This period is due to end on 30 June 2021 - hopefully the Adequacy Decision will be safely in place by then.