For UK businesses this is yet another complication arising from Brexit. I’m advising my clients, wherever possible, to separate data flows into EEA and non-EEA zones just in case the EU Commission does not grant an adequacy decision…:
United Kingdom, French and Belgian national security laws (and such laws of other EU Member States) fell under the scrutiny of the Court of Justice of the European Union (CJEU), which on October 6, 2020, ruled on whether such laws were compatible with European Union (EU) privacy, data protection and fundamental rights principles. The take-away point is that the CJEU confirmed that certain national security laws were incompatible with Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector (the “ePrivacy Directive”), which together with the General Data Protection Regulation (GDPR) provides the main pillars of the framework of EU data protection and privacy laws. This raises complex questions as to what steps EU Member States would need to take to resolve the tension between national security and protection of privacy. Further, as the United Kingdom (U.K.) leaves the EU at the end of 2020, negotiations are ongoing in relation to granting the U.K. an “adequacy” status, which would ensure seamless flows of personal data between the U.K. and the EU. Against that background, the fall-out from the rulings would be of particular importance to international businesses.
The steps the U.K. takes in particular will be watched closely by stakeholders. Obtaining an “adequacy” decision from the EU Commission once the U.K. leaves the EU at the end of 2020, i.e., a decision declaring that the U.K. has adequate data protection laws, would mean data flows between the EU and the U.K. can continue seamlessly. It is likely that the EU Commission would take into consideration the latest CJEU judgment when analyzing whether “adequacy” may be granted. We will provide material updates as they arise in the ongoing negotiations between the U.K. and the EU Commission.