Cybersecurity Policy Report, U.K. Data Will Flow Freely to EU Under ‘Adequacy’ Extensions, (Mar 18, 2025)
The European Commission (EC) has issued draft extensions of two “adequacy” decisions—one related to the level of the UK’s personal data protection laws as compared to the EU General Data Protection Regulation (GDPR) and one related to the level of such protections as compared to the EU Law Enforcement Directive (LED)—allowing for data transfers between the two jurisdictions. The draft adequacy decisions set forth an expiration date of Dec. 27 to account for amendments to the Data (Use and Access) Bill pending in the U.K. Parliament.
To decide on whether to renew the implementing decisions, the EC must assess whether the conclusion that the U.K. ensures an adequate level of protection for personal data transferred from the EU to the U.K. remains factually and legally justified, it said.
While the implementing decision continues to apply in the U.K., amendments to the Data (Use and Access) Bill proposing amendments to the U.K. General Data Protection Regulation and Data Protection Act 2018 are being assessed, the EC noted.
The EC extended the implementing decisions for a period of six months to allow the EC to carry out its assessment on the adequate level of protection for personal data provided by the U.K. on the basis of a stable legal framework and in consideration of the ongoing legislative process before the U.K. Parliament.
News: InternationalLegislation DataPrivacy GDPR