Debate: Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems  - Case C- - The adequate protection of personal data by the United Kingdom
Date: THURSDAY, 20 MAY 2021
Speaker: Ana Paula Zacarias
Language: EN

The Council believes that the EU must find the best solution to make the transfer of personal data possible to a European Economic Area third country, territory or international organisation, while at the same time respecting EU legislation and case-law. When the conditions are fulfilled, adequacy decisions should be adopted.  This is in line with the European Council Conclusions of October 2020, in which the heads of state or government welcomed the European strategy for data. This strategy supports the European Union’s global digital ambition to build a true European competitive data economy while ensuring values and a high level of data security, data protection and privacy. As you know, the Council itself does not take part in the adoption of adequacy decisions, although Member States are involved in the comitology procedures. This being said, let’s look at the transfer of personal data to the UK. According to the Commission explanations provided in the draft decision, the UK has chosen to keep its data protection framework fully aligned with the EU rules. The UK has strong safeguards in the area of government access to data and therefore provides an equivalent to data protection. These elements are essential, both to safeguard economic activity and to maintain a high level of cooperation with the UK in different sectors, including law—enforcement cooperation. The Trade and Cooperation Agreement (TCA) provides for a maximum of six months during which the UK is not to be considered a third country for the purpose of transferring personal data, and, as you know, this period expires at the end of June.  After the draft adequacy decisions have been presented by the Commission and the European Data Protection Board provides its opinion, the process of adopting the adequacy decisions should be completed in time to make sure that there is a solid legal base for the transfer of personal data with the UK. So, we will continue to support the Commission to come up with solutions that at the same time respect the fundamental rights of the Union and the TCA timeframe. That is essential, both to safeguard economic activity, in particular for SMEs and startups, and to maintain a high level of cooperation with the UK in different sectors, including law enforcement, as I said, and judicial cooperation. The UK will continue to be a very important partner of the European Union in these areas. Besides, adequacy decisions are not the end of the story – it is always important to keep an eye on evolution in the third state concerned, and the adequacy decisions provide for such a mechanism, in addition to the well—known sunset clause. This is also an important safeguard as it is important to make sure that the UK maintains a high level of protection of personal data in the future, and, if there are problematic divergences, this will certainly have consequences. Now let’s talk about the transfer of personal data to the United States. Turning to this point, it is clear that the invalidation of the Privacy Shield by the European Court of Justice has important implications, even if the Court upheld the validity of the standard contractual clauses. These standard contractual clauses for the transfer of personal data will soon be updated, and they play an important role by providing additional legal certainty. We are confident that negotiations will intensify, following the joint statement by Commissioner Reynders and the US Secretary of Commerce, Gina Raimondo, of 25 March. The Council and the Member States are following these negotiations closely on the basis of information provided by the Commission and I look forward to hearing Commissioner Reynders speak on this topic.