As reported in our Summer Newsletter, cross border transfers of personal data continue to be a hot topic in data protection law. BREXIT technically meant that the UK ceased to be able to exchange personal data freely with the remaining member states of the EU, pending a formal decision by the EU on the adequacy of the UK’s rights and protections.

In theory the decision should not have been problematic given that the UK had the same rights and protections in operation as other member states but for two considerations, that the UK might subsequently diverge and that the UK was only permitted to apply for a finding that the UK’s laws were sufficient properly to protect personal data after BREXIT had occurred. A temporary fix was put in place by the EU known as an ‘adequacy bridge’ to allow the EU to continue to treat the UK as having all necessary rights and protections pending the full decision.

The European Commission by way of two separate decisions has now confirmed the UK as ‘adequate’ as of 28 June 2021 meaning that data can continue to flow freely between the EU and the UK without additional safeguards being required by the EU. The confirmation means that trustees and employers of occupational UK based pension schemes can continue to exchange personal data with service providers and group employers based in EU member states in exactly the same way as before BREXIT, so maintaining the status quo of the free flow of personal data in and amongst European countries comprising the UK and the EU member states. The confirmation was accompanied by a 4-year ‘sunset clause’ limiting the duration of adequacy, meaning that any regulatory divergence by the UK will be kept under review.