Yesterday the EU officially accepted that the UK Data Protection Act (DPA) 2018, was adequate to protect EU citizen’s data. A new announcement, but not unexpected…
As the DPA 2018 is heavily based upon GDPR and some would say in some areas stronger, this is not a surprise. But it is a classic case of leaving it till the last minute. The current agreement, the EU-UK Trade and Cooperation Agreement (TCA) expires on the 30th of June 2021.
What does this mean?
The agreement means that EU citizen data can be shared with UK based data processors, without the need for additional verification of the controls.
Anything to watch out for?
One thing that all organisations should be made aware of, is that this agreement is only for four years. At the end of that time, the EU will reassess the Data Protection Act to make sure it’s still adequate. Four years in business terms is not that long, but in technology terms, it is a lifetime.
Data protection professionals should also note, that there has been the equivalent acceptance that the data protection controls are adequate under the terms of the Law Enforcement Directive. As a result, this means that law enforcement can access and share data on EU citizens as well.
1. The Information Commissioners office statement is below:
2. And the EU’s decision statement is here:
Commission adopts adequacy decisions for the UK (europa.eu)
Cyber Security Partners Ltd offer a subscription-based Data Protection as a Service (DPaaS). This gives you access to data protection experts on an hourly basis and regular updates on data protection news. For more information contact us at DPaaS@csp.partners or via www.csp.partners.