Adequacy Decision
See the sections in relation to the General Data Protection Regulation which became effective in May 2018. After Brexit, the UK will become a third country for the purpose of EU data protection legislation. Subject to and in the absence of other agreements or legislation, the free flow of personal data from the EU to the UK will require an adequacy decision in respect of the UK’s data protection standards.
Given the existence of complete harmonisation and conformity, it might reasonably be expected that this decision will be readily forthcoming. However, it may not be so, or it may not be immediately put in place. In addition, the possibility of future variations and changes in law by unilateral UK legislation may affect the approval or terms of approval.
No Adequacy Decision
In the absence of an adequacy decision, the flow of personal data from the EU may be permitted provided that there are appropriate safeguards. They may include safeguards provided for by
- standard data protection clauses including
- model clauses published by the Commission,
- binding corporate rules approved by the competent authority which apply within a corporate group
- approved codes of conduct together with binding and enforceable commitments of the controller processor in the third country
- approval certification mechanisms together with binding and enforceable commitments of the controller processor in the third country.
In the absence of an adequacy decision or appropriate safeguards, the transfer may take place on the basis of derogations. They allow transfers in specific cases such as based on consent, the performance of a contract, the exercise of legal claims and for important reasons of public interest.
