Most Favoured Nation: The Brussels Effect Strikes Again

Data adequacy agro

Welcome to the 118th edition of Most Favoured Nation. The full post is for paid subscribers only, but you can sign up for a free trial below.

---

A few weeks ago, I wrote about a study published by Northern Ireland’s Department for the Economy that claims the proposed new UK Data Protection and Digital Information Bill could lead to the EU revoking its UK data adequacy decisions.

I assume most of you are aware of the basics, but in case not: On 28 June 2021, the European Commission adopted two data adequacy decisions (under GDPR and the Law Enforcement Directive), allowing the personal data of EU citizens to be transferred to, and processed in, the UK.

This was good news for pretty much every business that handles EU personal data in the UK.

As part of the Commission’s efforts to keep Austrian privacy campaigners and the European Court of Justice from questioning the legitimacy of the decisions, it included a sunset clause, which limits the duration of the decisions to four years unless it decides to renew.¹

Anyhow, the report claims that the Data Protection and Digital Information Bill causes problems for four reasons:

1. Independence and Political Influence: Changes related to independence and political influence have the potential to threaten UK adequacy status. This is likely the most significant risk to adequacy contained in the DPDI (No 2) Bill.

2. Access to Effective Individual Remedies: The dilution of the individual right to lodge a complaint in favour of a shift to more strategic enforcement has the potential to undermine the UK adequacy decision.

3. Onward Transfers of Personal Data: The DPDI (No 2) provision for onward transfers is likely to be subject to intense scrutiny by the Commission. Additional assurances and safeguards aligned with EU standards are likely to be required.

4. Changes to the rights of individuals and other societal safeguards: Taken individually, these changes are likely to be acceptable on the basis that the standard of adequacy is essential equivalence and not identical protection. That being said, the changes could be viewed as contributing to a general degradation in data protection rights and that could go against the UK in a holistic assessment of adequacy.

And guess what? It appears as if the UK government agrees that at least point 1 does indeed pose a problem.