Under UK law, personal data can currently flow freely from the UK to the EU. The trade agreement also ensures the continued temporary free flow of personal data from the EU to the UK until adequacy decisions are adopted. The European Commission published positive draft adequacy decisions on 19 February and we expect the EU to complete the technical approval process soon.
We all know how important the flow of data is for UK business, but frankly the Government have handed the powers to the EU to turn our data on and off. They have turned us into supplicants, effectively. What are the contingency plans, given that relationships are frosty, should the EU use those powers?
As I say, the EU Commission has already provided an assessment of the UK’s data protection laws, which found us to be adequate, and there is absolutely no reason why that should not be confirmed once the processes are under way. However, we have said that it is sensible for businesses to make contingency plans by putting alternative transfer mechanisms in place, just in case there comes a point at some future date, but we expect adequacy to be granted within the timescale permitted.