EU/UK transfer of personal data – an update on the EU Parliament’s resolution 

 In EU, Personal Data

On 21 May 2021, the European Parliament adopted resolution 2021/2594(RSP) on the adequate protection of personal data by the United Kingdom.  This resolution is part of the EU legislative procedure following the adoption by the EU Commission of two draft adequacy decisions back on 19 February 2021, one pursuant to the GDPR and the other pursuant to the Law Enforcement Directive for Data Protection (read more about these draft decisions here).

In this resolution, amongst others, the EU Parliament:

  • calls upon the EU Commission to amend its drafts with a view of making them fully consistent with EU law and case law;
  • stresses that all recommendations made in the European Data Protection Board’s (EDPB) opinion should be taken on board;
  • requests that national data protection authorities suspend the transfer of personal data, which might be subject to indiscriminate access by UK intelligence authorities, if the EU Commission were to adopt its adequacy decisions in relation to the UK before the UK solves the issues mentioned in this resolution;
  • calls on the EU Commission to keep on closely monitoring the level of data protection as well as laws and practices on mass surveillance in the UK; also points out that there are other legal possibilities for transfers of personal data to the UK in Chapter V of the GDPR; and recalls that in line with EDPB guidelines, transfers relying on derogations for specific situations pursuant to Article 49 of the GDPR must be exceptional;
  • calls on the EU Commission and the UK competent authorities to set up an action plan in order to address as soon as possible the deficiencies identified in the EDPB opinions and other outstanding issues in UK data protection, which must be a precondition for the final adequacy decision;
  • calls on the EU Commission to closely monitor data protection law and practices in the UK, to immediately inform and consult Parliament on any future changes to the UK data protection regime, and to give EU Parliament a scrutiny role in the new institutional framework, including for relevant bodies such as the Specialised Committee on Law Enforcement and Judicial Cooperation.

 

Read the full text of the EU Parliament resolution here.

If you have any questions in regard to this topic, please do not hesitate to contact us.