‘Inadequacy' – An Inevitable End To 2020?

With Brexit on the horizon, potential changes to data transfer laws raise the spectre of disruption to personal data transfers from the European Economic Area (EEA) to the UK.

From 1 January 2021, the UK will be considered a third country outside of the EEA for the purposes of the General Data Protection Regulation (EU) 2016/679 (GDPR). Ahead of this deadline, businesses should start thinking pragmatically about personal data transfers from the EEA to the UK to ensure a frictionless transition in case a European Commission 'adequacy decision' is delayed, or worse, not granted at all.

So what is 'adequacy'?

European Commission 'adequacy decisions' constitute findings by the Commission that the legal frameworks and data protection regimes of countries, territories, sectors or international organisations outside the EEA are 'essentially equivalent' to those established by the GDPR and provide 'adequate' protection for individuals' personal data.