The European Data Protection Supervisor (EDPS), Wojciech Wiewiórowski, issued his opinion on Monday 24 February regarding the future data protection relationship with the United Kingdom.
“Given the close cooperation that is expected to continue between the EU and the UK at the end of the transition period, the EDPS also welcomes and supports the Commission’s commitment in its Recommendation to work towards the adoption of adequacy decisions, provided that the relevant conditions are met”, he writes.
He is of the opinion that a decision by the European Commission establishing that the United Kingdom offers a level of protection of personal data comparable to that guaranteed in the EU would be the appropriate tool to govern the future relationship with the UK. Such a decision would allow personal data to move freely and securely between the EU and the UK without the need for additional safeguards or authorisations.
Nevertheless, the EDPS does have some recommendations and warnings to make. “Given the unique status of UK as a former Member State of the EU having, in principle, integrated all the EU acquis into its national law, the EDPS would like to emphasise that any substantial deviation that would result in lowering the level of protection would constitute an important obstacle to a finding of adequacy”, he warned.
In early February, UK Prime Minister Boris Johnson said that the UK would develop “separate and independent policies” in a range of areas, including data protection. While he promised that the UK government would seek to maintain high standards in this area, his words left doubt as to whether the EU's General Data Protection Regulation (GDPR) would apply in UK law.
According to the EDPS, the scope of the envisaged adequacy decisions will also need to be clearly defined in order to clarify the legal framework relevant for the different forms of data exchange envisaged in the partnership, such as PNR data within the framework of the Security Partnership.
It is also calling for economic and security partnerships to be supported by commitments to respect fundamental rights, including the adequate protection of personal data.
Finally, the EDPS recommends that the EU takes steps to prepare for all eventualities, including a situation where the adequacy decision(s) were not able to be adopted during the transitional period, where no adequacy decision is adopted at all, or where it is adopted only in respect of certain areas. If the European Commission presents a draft adequacy decision, the EDPS should, in any case, be involved in an appropriate and timely manner, he says.
Read his opinion: https://bit.ly/2vhJfKh (Original version in French by Marion Fontana)