C 15/220
EN
Official Journal of the European Union
12.1.2022
Friday 21 May 2021
C. whereas the UK has traditionally been an important trading partner of many EU Member States, as well as a close ally in the area of security; whereas the EU and the UK should maintain this close cooperation despite the UK’s withdrawal from the EU, as this will be beneficial for both sides;
D. whereas European businesses need legal clarity and certainty, as the ability to transfer personal data across borders has become increasingly important for all types of companies that deliver goods and services internationally; whereas an adequacy decision concerning the UK under the GDPR is of the utmost importance, as many European businesses conduct trade across the Channel, in particular given the fact that Brexit is still very recent and data flows within the Union have not been subject to restrictions; whereas failing to adopt a robust adequacy framework would risk disruptions in commercial cross-border transfers of personal data between the EU and the UK, as well as high compliance costs;
E. whereas the Trade and Cooperation Agreement (TCA) includes a number of safeguards and conditions for exchanging relevant personal data in the context of law enforcement; whereas the negotiations on personal data flows were conducted in parallel to the negotiations on the TCA but were not finalised by the end of the transition period on 31 December 2020; whereas a ‘bridging clause’ was included in the TCA as an interim solution, conditional upon the commitment by the UK not to change its current data protection regime, in order to ensure the continuation of personal data flows between the UK and the EU until the adoption of an adequacy decision; whereas the initial four-month period has been extended and will expire at the end of June 2021;
F. whereas the assessment carried out by the Commission before it presented its draft implementing decision was incomplete and inconsistent with the CJEU requirements for adequacy assessments, which was highlighted by the EDPB in its adequacy opinions, where it advises the Commission to further assess specific aspects of UK law and practice relating to bulk collection, overseas disclosure and international agreements in the field of intelligence sharing, additional use of the information collected for law enforcement purposes and the independence of judicial commissioners;
G. whereas certain aspects of UK law and/or practice have not been considered by the Commission, which has led to draft implementing decisions which are inconsistent with EU law; whereas Article 45 of the GDPR says that ‘when assessing the adequacy of the level of protection, the Commission shall, in particular, take account of… relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law’, and that ‘the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data’, which includes international agreements in other areas involving access to data or information sharing, and therefore requires an assessment of such international agreements;
H. whereas the CJEU clearly stated in its Schrems I judgment that ‘when examining the level of protection afforded by a third country, the Commission is obliged to assess the content of the applicable rules in that country resulting from its domestic law or international commitments and the practice designed to ensure compliance with those rules, since it must, under Article 25(2) of Directive 95/46/EC, take account of all the circumstances surrounding a transfer of personal data to a third country’(paragraph 75);
I. whereas intelligence services activities and sharing with third countries are excluded from the scope of EU law as per the Treaties when it comes to Member States, as these are included in the scope of the necessary adequacy assessment of the level of personal data offered by third countries, as confirmed by the CJEU in the Schrems I and II judgments;
J. whereas data protection standards rely not only on the legislation in place, but also the application of those laws in practice, and whereas the Commission only assessed the legislation, not the actual application in practice, when preparing its decision;