The European Commission has launched the process to adopt new adequacy decisions to allow the free flow of personal data between the European Economic Area and the United Kingdom. Following its assessment of the recently adopted UK Data Use and Access Act, the Commission has concluded that the UK's legal framework continues to provide data protection safeguards that are essentially equivalent to those provided by the EU.

European Commission starts process to maintain data flows between EU and the UK www.scl.org/european-com...

Draft adequacy decisions commission.europa.eu/law/law-topi...

These go next to the EDPB for its opinion – but all looks like smooth sailing really.

#dataprotection #dataadequacy #dataflows

Allowing third countries such as the UK to benefit from unrestricted personal data flows with the EU while simultaneously weakening legal safeguards at home does not only endanger the rights of people in the EU — it also undermines the credibility of the EU's data protection framework, exposes EU businesses to unfair competition, and devalues the Union's regulatory leadership on the global stage.

Civil society organisations have written an open letter urging the European Commission not to re-adopt the UK's data adequacy decisions edri.org/our-work/uk-... + coverage www.computerweekly.com/news/3666253...

#DUABill #dataprotection #dataadequacy

3. Reduce trade friction and ensure data flows. Scientists need timely delivery of items for research. 📊 Sharing health data safely is a pillar of research cooperation. The UK and the EU should grant each other #DataAdequacy. UK Gov mustn’t put at risk the EU’s decision. bit.ly/3EqIwKi 6/9

Commission proposes to extend adequacy decisions for the UK by six months for free and safe data flows Today, the Commission has proposed to adopt an extension of the two 2021 adequacy decisions with the United Kingdom for a period of six months. With this extension, the free flow of data with the UK would be maintained until 27 December 2025. This will allow time for the legislative process to conclude in the UK. Once concluded, the Commission will assess the new legal framework and decide on its adequacy. In the meantime, the UK data protection rules that were found adequate in 2021 remain in place and continue to apply to data transferred from the EU. …

The European Commission proposes to extend existing #dataadequacy decisions for the UK by six months ec.europa.eu/commission/p... (scroll down)

The decisions are currently scheduled to expire on 27 June.

Recent briefing www.europarl.europa.eu/thinktank/en...

#DUABill #dataprotection #dataflows

The United Kingdom (UK) adequacy decisions are set to expire on 27 June 2025, unless the European Commission reaffirms that the UK continues to ensure an 'essentially equivalent' level of data protection to the EU's. Critics raised concerns that recent and ongoing UK reforms could jeopardise the renewal of these decisions.

Navigating challenges to UK data adequacy www.europarl.europa.eu/thinktank/en... short briefing from the European Parliamentary Research Service

#DUABill #dataprotection #dataadequacy

UK House of Commons written question UIN 33205, tabled on 24 February 2025 and answered 4 March 2025: Martin Wrigley Liberal Democrat, Newton Abbot Commons To ask the Secretary of State for Science, Innovation and Technology, whether he has had discussions with his American counterpart on the security provisions in place for UK citizens that have data held by US Government Departments, in the context of recent steps taken by the US Department of Government Efficiency to access personal data. Answer Chris Bryant Labour, Rhondda and Ogmore Commons The UK-US special relationship continues to be critical for our security, growth and prosperity, as reiterated by the Prime Minister and President during the recent visit. Under the UK data protection regime, organisations must ensure there are appropriate safeguards in place when sending UK personal data internationally. The UK has an adequacy decision for certain transfers to the US and robustly monitors any developments that could affect that decision. Where an adequacy decision cannot be relied upon, UK organisations must ensure alternative safeguards are in place, such as contractual clauses, in accordance with Article 46 of the UK GDPR.

well that's reassuring questions-statements.parliament.uk/written-ques...

#cybersecurity #dataprotection #dataadequacy

The two officials, who spoke to Reuters on condition of anonymity for fear of retaliation, said some senior career employees at OPM have had their access revoked to some of the department's data systems. The systems include a vast database called Enterprise Human Resources Integration, which contains dates of birth, Social Security numbers, appraisals, home addresses, pay grades and length of service of government workers, the officials said. "We have no visibility into what they are doing with the computer and data systems," one of the officials said. "That is creating great concern. There is no oversight. It creates real cybersecurity and hacking implications."

At some point* UK MPs might want to ask ministers whether the US is still considered a safe third country for purposes of international data transfers www.reuters.com/world/us/mus...

UK-US data bridge www.gov.uk/government/p...

#cybersecurity #dataprotection #dataadequacy

* now would be good

Lord Clement-Jones, among other peers, has pointed out to the government that it seems to be simultaneously insisting that the reforms proposed in the DUA Bill are necessary, but that it will change nothing. While that opens the door to new EU-UK adequacy decisions, it will not deliver the sort of streamlining of compliance burdens that businesses want to help them deliver on the government’s own growth missions in 2025 and beyond.

UK #dataprotection law facing scrutiny and reform in 2025 www.pinsentmasons.com/out-law/anal...

Summary of some substantive issues raised in Lords committee debates; useful if you haven't been following along.

Data (Use and Access) Bill bills.parliament.uk/bills/3825/p...

#DUABill #dataadequacy

Letter from UK minister Peter Kyle to European Affairs Committee, on how Government is managing risks to UK-EU data adequacy committees.parliament.uk/publications... HT @jakubkrupa.bsky.social

Inquiry docs committees.parliament.uk/work/8338/uk...

#DUABill #dataprotection #dataadequacy #dataflows

We held seven evidence sessions and received 21 written submissions, but were not able to hold a final evidence session with the then-Minister and to produce a report before the summer recess, given the timing of the General Election. Now, the political context has changed significantly — in particular, the previous Government's Data Protection and Digital Information Bill (DPDI Bill), which was the focus of much of our evidence, fell at dissolution. Nevertheless, the June 2025 expiry of the UK's EU adequacy status still looms, and the Government plans a Digital Information and Smart Data Bill covering some of the same issues as its predecessor’s DPDI Bill.

Lords committee urges UK Government to begin new talks with EU over data adequacy www.independent.co.uk/business/lor...

European Affairs Committee letter with conclusions and recommendations from inquiry committees.parliament.uk/publications...

#dataprotection #dataadequacy #dataflows #DISDBill

Even under the current regime, several experts consider the ICO's enforcement activities as weak. At the same time, the Bill appears to further undermine, not merely the effectiveness, but beyond that the independence of the ICO. In particular, there is a risk that the Commissioner will have a duty to consider factors outside its primary expertise when balancing between the protection of personal data and other interests such as the UK economy, public safety or the international agenda of the UK Government prior to exercising their powers, or, having to follow priorities set by the Secretary of State.

Three "most controversial" issues with UK data protection reforms, as identified by the EU Parliament's LIBE Committee:

● changes to the definition of personal data
● the role of the UK Information Commissioner
● onward transfers of personal data

#DPDIBill #dataadequacy #dataprotection #dataflows

The LIBE Committee is concerned about the overall direction of the data policies of the UK Government. The current actions of the Government appear to be aimed at (i) eliminating constraints arising from European or international law, and (ii) limiting the impact of European court jurisdiction and European court interpretations on UK law. Finally, the LIBE Committee also observes a switch towards using executive legislative powers in these policies with limited oversight from the UK Parliament. In the opinion of the LIBE Committee, these factors, as well as other issues mentioned in this contribution, may increase UK divergence from EU data standards, putting the validity of the adequacy findings into question.

Written evidence from the European Parliament's Committee on Civil Liberties, Justice and Home Affairs to the UK House of Lords inquiry into data adequacy committees.parliament.uk/writtenevide...

Inquiry committees.parliament.uk/work/8338/uk...

#DPDIBill #dataadequacy #dataprotection #dataflows

The inquiry will focus, in particular, on the following themes: ● Assessment of the existing adequacy arrangement underpinning data flows between the UK and the European Union ● Possible challenges to UK-EU data adequacy regime ● Implications of a no or disrupted UK-EU data adequacy scenario ● Lessons learned from other countries' experiences with the adequacy system and engagement with the European Commission's process The committee invites interested individuals to submit written evidence by 12pm on Friday 3 May 2024. Public evidence sessions are expected to take place between March and June, and the Committee aims to report to the House by July 2024.

#Dataadequacy and its implications for the UK-EU relationship examined committees.parliament.uk/committee/51... launch of UK House of Lords inquiry #dataprotection

I think this inquiry is timed to take into account the #DPDIBill in its final form (unless the Government calls a general election).