The European Commission has launched a major consultation on whether to renew the UK’s data transfer deal with the EU, estimated to be worth £161bn year to the British economy, following the passing of the new Data (Use & Access) Act.
Brussels has also at long last confirmed it has adopted a six-month extension of the two data adequacy decisions, one under GDPR and the other under the Law Enforcement Directive. The decisions, adopted in June 2021, allow for the free flow of personal data between the EU and UK, subject to certain limitations.
The original deal was due to expire this week (June 27) but has now been extended to December 27 2025.
On announcing the extension, European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath said: “Data is the lifeblood of trade, justice, and law enforcement. This extension ensures vital data flows between the EU and UK continue without disruption, supporting cross-border business and cooperation. It gives us time to assess the UK’s new data law while maintaining stability in our key partnerships.”
The Commission says it is now assessing whether the new legal framework under the UK Data Act continues to provide an adequate level of protection for personal data. On the basis of this assessment, the Commission will decide whether to renew the deals.
The process involves an opinion by the European Data Protection Board, scrutiny from the European Parliament and green light from the EU Member States.
However, in its assessment, the Commission will also consider information received from a number of other sources, including the UK Government, public sources, such as oversight and enforcement authorities, as well as from stakeholders such as civil society and business associations.
Naturally, supporters of the Data Act maintain that the agreement with the EU is safe, but there are plenty of others who disagree.
Last month, a consortium of privacy organisations published an open letter addressed to Commissioner McGrath, urging him to rip up the deal.
The group, which includes Privacy International, European Digital Rights, Access Now, and Statewatch cited “a sustained and systemic erosion of privacy and data protection standards” in the UK, adding that “this degradation would be furthered by the UK Data (Use & Access) Bill, pursued in the name of simplification”.
The letter added: “The Commission needs to act decisively, or risks leaving the UK adequacy decisions open to a judicial challenge. A judicial invalidation of the UK adequacy decision would also disrupt key areas of EU-UK cooperation, including the Trade & Cooperation Agreement (TCA), the Windsor Framework, and the UK’s participation in Horizon Europe.
“This would directly set back the Commission’s and Member States’ efforts to strengthen ties and pursue further collaboration with the UK.”
Back in October, the cross-party House of Lords European Affairs Committee also expressed concerns about how the legislation will go down in Brussels.
In addition, privacy organisation Big Brother Watch has claimed the Act will set the UK years behind international partners when it comes to safeguarding against the threats of new and emerging technologies such as AI.
Even the Law Society has waded in, while, last week, the Open Rights Group pointed out that losing the adequacy status when the Government is trying to grow the economy “would be disastrous for the UK”.
Related stories
Data Act jitters build as firms face race to get in shape
DMA claims Data Act victory as privacy groups seethe
ICO unveils business guidance as Data Act becomes law
Four years in the making, UK data reforms are passed
Fresh call for Brussels to scrap UK adequacy agreement
Lords on alert over EU deal as Data Bill concerns grow
