The EU Commission has today (28 June 2021) announced its adoption of two adequacy decisions for the United Kingdom - one under the General Data Protection Regulation ("GDPR") and the other for the Law Enforcement Directive ("LED") (the "Adequacy Decisions").

Under the terms of the EU-UK Trade and Cooperation Agreement, a temporary arrangement was agreed that allowed personal data to continue to flow freely from the EEA to the UK without additional safeguards being put in place (e.g. Standard Contractual Clauses). This temporary arrangement was due to expire on 30 June 2021.

By adopting the Adequacy Decisions, the EU Commission has recognised that the UK has fully incorporated the principles, rights and obligations of the GDPR and the LED into its legal system and that, as a result, UK law offers an "essentially equivalent level of protection to that guaranteed under EU law".

The effect of the Adequacy Decisions is that personal data can flow freely from the EEA to the UK without any further safeguards being necessary. In others words, the transfers are treated as intra-EU transmissions of personal data.

The Adequacy Decisions are subject to a "sunset clause". This means that the Adequacy Decisions will expire in four years unless renewed by the EU Commission on the basis that it is satisfied that UK law continues to provide a sufficient degree of protection for personal data at that time. The EU Commission noted in its announcement that, for the duration of the Adequacy Decisions, it will continue to monitor the legal situation in the UK and if the UK deviates from the level of protection currently in place, it would take appropriate action to address any adverse consequences that such deviation could have on the protection of personal data.