EDPB raises concerns over UK’s adequacy application
The European Data Protection Board declares that the UK-US agreement on access to personal data between both countries for the purpose of preventing and prosecuting serious crime may hinder the UK’s aim for an adequacy decision from the EU.
In a letter to the European Parliament, dated 15 June, the EDPB President, Andrea Jelinek writes that the agreement concluded between the UK and the US will have to be taken into account by the European Commission in its overall assessment of the level of protection of personal data in the UK, in particular as regards the requirement to ensure continuity of protection in case of ‘onward transfers’ from the UK to another third country.
“Should the European Commission present a draft adequacy decision for the UK, the EDPB will provide its own assessment in a dedicated opinion,” Jelinek says.
The DPAs stress that the necessary safeguards include ‘a mandatory prior judicial authorisation as an essential guarantee for access to metadata and content data’, and in their initial assessment, this was lacking in the UK agreement. The agreement between the UK and the US on Access to Electronic Data for the Purpose of Countering Serious Crime was signed 3 October 2019, but is not yet in force.
The UK has until the end of the transition period, 31 December 2020, to negotiate an agreement with the EU. The EU is likely to pay close attention to the surveillance provisions in the UK’s Investigatory Powers Act 2016, as they may be deemed incompatible with the GDPR.
Follow PL&B UK Report for more information on the UK-EU negotiations.