A further update that as of today, 28 June 2021, the European Commission has adopted two UK adequacy decisions. The first under the EU GDPR and the second, which covers transfers of personal data for law enforcement purposes, under the Law Enforcement Directive.
The adequacy decisions confirm that the UK does offer an equivalent level of personal data protection to the EU regime, and will allow the continued free flow of personal data from the EU into the UK without additional safeguards.
This is welcome news for many and will ensure that, at least for now, international data transfer restrictions are not an obstacle for trade and collaboration between the EU and UK.
The adequacy decisions are limited in duration to four years, after which the European Commission can decide whether or not to renew the UK's adequacy status. In order for the decisions to be renewed though, the formal adoption process would need to be followed again, including another vote by EU Member State representatives.
In the European Commission's press release earlier today it also stressed that "during these four years, the Commission will continue to monitor the legal situation in the UK and could intervene at any point, if the UK deviates from the level of protection currently in place". This is a clear warning that the decisions can be revoked if personal data protection in the UK is eroded during the initial adequacy term.
Nevertheless, approval of the UK adequacy decisions is an important milestone for many businesses across the UK and EU for which international personal data sharing is a central part of their day-to-day operation.