After Brexit there were numerous the doubts regarding the data protection system in the United Kingdom: in fact, since it is no longer part of the European Union starting from January 2021, it was necessary to find an agreement between the parties, so that European data can circulate safely on British territory.

On 28th June 2021, the European Commission finally announced the agreement between the two shores of the English Channel: two adequacy decisions, were adopted, one under the General Data Protection Regulation (GDPR) ) and the other for the Directive on law enforcement.

The UK has fully incorporated the principles, rights and obligations of the GDPR and the Law Enforcement Directive into its post-Brexit legal framework, so its data protection system has not changed since it was a Member State and therefore remains equivalent to the current one guaranteed in Europe.

Access to personal data by public authorities in the UK is also no longer of particular concern, as strong safeguards have been put in place: la data collection by authorities is subject to prior authorization from an independent judicial body and any measures it must be necessary and proportionate to what one intends to achieve. In addition, the United Kingdom is subject to the jurisdiction of the European Court of Human Rights and must accede to the European Convention on Human Rights as well as the Council of Europe Convention for the Protection of Individuals with regard to Automated Processing of Personal Data, which it is the only binding international data protection treaty.

A novelty consists in the introduction of the so-called ‘lapse clause’ incorporated in the adequacy decisions: the latter will have a limited duration of four years from their entry into force. Upon expiry, they may be renewed, as long as the UK continues to ensure an adequate level of data protection and security. During the period of validity, the European Commission will in any case continue to monitor the legal situation of the United Kingdom and, in the event of deviations, it may intervene at any time.

To date, therefore, the full implementation of the GDPR and the solid guarantees placed on adequacy decisions in the event of future divergences, guarantee full freedom of data circulation between the EU and the UK.

For further information, please visit the official web page of the European Commission.