EC postpones review of UK data adequacy decisions by 6 months

The European Commission (EC) has announced a six-month delay in reviewing the UK's data adequacy, moving the deadline to December 2025. This review is crucial as the EC will determine whether the UK offers an "adequate" level of data protection or data transfers.

For a country to be considered "adequate", the EC must formally recognise that the country offers an "essentially equivalent" level of data protection to that of the EU. If a country is deemed adequate, this permits personal data to be transferred from the EU to the UK without additional safeguards.

Why is an extension necessary?

The extension is primarily due to the UK's Data (Use and Access) Bill (DUA Bill), currently progressing through Parliament. The extension is necessary to allow the DUA Bill to pass and for the EC to assess whether the new legislation aligns with the EU regulatory framework.  

The DUA Bill aims to enhance the flow of personal data from the UK to other countries that offer comparable protection levels. The Secretary of State will implement a new "data protection test" to evaluate the data protection standards of other countries for international transfers. This test ensures that the protection level in the receiving country is not "materially lower" than that in the UK, a similar test to that of the EC adequacy review.

What is the importance of UK adequacy?

Maintaining the UK's adequacy status is vital for the economy. When the Information Commissioner’s Office (ICO) confirmed the UK's adequacy status granted by the EC, it was a significant relief for the UK economy. Without this status, organisations would need to implement additional safeguards to transfer personal data from the EU to the UK, which could be costly and impact their competitiveness.

The free flow of personal data is crucial for both imports and exports of goods and services. According to a paper by the government's Department of Science, Innovation and Technology, the continued EU adequacy is projected to have a net present value of £2bn over a 10-year period.

In summary

The extension will allow for a thorough review of the UK's data protection regime in light of the new DUA Bill, ensuring that data flows can continue seamlessly and securely, significantly benefiting the UK economy.