Answer given by Mr Reynders on behalf of the European Commission

1.2 The Commission has comprehensively reviewed the United Kingdom (UK)’s data protection law and practice, including the system of government access to data for law enforcement and national security purposes, and assessed this against the relevant standard of ‘essential equivalence’ with Union data protection law, as interpreted by the Court of Justice of the EU. It has also taken into account the UK’s adherence to the European Convention of Human Rights and its submission to the jurisdiction of the European Court of Human Rights. The draft decisions detail this assessment, including the definition of personal data[1] and the exercise of the different surveillance powers[2].

The draft decisions propose that the adequacy findings expire after four years and a new adequacy procedure is required for their potential renewal. Moreover, the Commission will continuously monitor relevant developments in the UK’s data protection law and practice to assess whether it still ensures an essentially equivalent level of protection. If this is no longer the case, and failing timely measures by the UK to address this, the Commission will suspend or repeal the decisions[3]. Any potential evolution of the UK data protection regime will thus be held against the same high standard as the initial assessment.

3. Art. FINPROV.10A of the EU-UK Trade and Cooperation Agreement (TCA)[4] only applies during an interim period of maximum six months. The period of five working days only concerns the initial request by the EU to trigger the procedure for the Partnership Council to meet, not the full reaction on substance. Irrespective of this consultation procedure, the UK remains bound by the TCA and individuals can rely on available administrative and judicial redress possibilities under EU and UK law to ensure the protection of their personal data.

• [1] See recitals 22 and 28 of the draft Commission Implementing Decisions pursuant to Regulation (EU) 2016/679 (GDPR) and Directive (EU) 2016/680 (LED) respectively , available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661
• [2] See recitals 172-265 of the draft GDPR decision.
• [3] Articles 45(4)-(5) of Regulation (EU) 2016/679 and 36(4)-(5) of Directive (EU) 2016/680; see recitals 274-280 and 164-170 of the draft GDPR and LED decisions respectively.
• [4] Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, OJ L444 of 31 December 2020, p.14.