"Significant improvements are needed should the European Commission wish to adopt an adequacy decision," the watchdog said.
|
|
Although originally the UK said it would adhere to GDPR standards, Google's decision suggests it doesn't trust Britain to achieve an adequacy agreement.
|
|
Broader threats that the UK might leave the EU without a deal exacerbate the possibility that it might not get an adequacy agreement, according to Burns.
|
|
Another possibility is for the UK to receive an adequacy decision from the EC — such as the Commission has granted to other third countries (like the US).
|
|
"An adequacy decision will be made by the Commission, and can be struck down by the European Court of Justice whatever our own position is," Bernal notes.
|
|
If granted, an adequacy decision is an EU mechanism for enabling citizens' personal data to more easily flow from the bloc to third countries — as the UK will be after Brexit.
|
|
"An adequacy decision would be great news for business as it would allow for the transfer of personal data from the EU to Japan without the need for extra authorisations," Jourova said.
|
|
This is not the action of a company which believes the UK will secure an adequacy agreement or intends to continue aligning itself with the European data protection framework and its user rights.
|
|
It proposed using an "adequacy" agreement — whereby the European Commission recognizes the levels of protection provided by non-EU countries — to ensure the flow of information vital to businesses and the police was not interrupted.
|
|
Originally Britain maintained that it would seek the second option, otherwise known as an "adequacy agreement," with the EU. This would mean Europe accepts that the UK provides data protection that's up to the EU's standards.
|
|
"As regards data-sharing for commercial purposes, we note the approach taken by Switzerland, which has secured both an adequacy decision from the EU and a mirror of the Privacy Shield agreement with the US," it writes.
|
|
Experts told Business Insider the problem boils down to whether the UK can obtain an "adequacy agreement" with the EU which would guarantee that EU citizens' data would be protected with the same rigor as under GDPR.
|
|
If we look at an adequacy decision by the Commission that is a one-way decision judging the standard of UK law and the framework of UK law to be adequate according to the Commission and according to the Council.
|
|
The European Commission today released an adequacy decision on the agreement, effectively giving it a seal of approval, though as The New York Times reports, the EU also released a separate document on Monday calling for the US to strengthen its domestic privacy protections.
|
|
Because as it stands, with the UK set to exit the EU next year — and even if an adequacy decision was secured — the ICO will lose its seat at the table at a time when EU privacy laws are setting the new global standard, thanks to GDPR.
|
|
The committee also notes there are specific concerns about the U.K.'s ability to "maintain deep police and security cooperation" with the EU and its Member States in the immediate aftermath of Brexit should the government fail to secure a transitional arrangement ahead of being able to obtain an adequacy decision.
|
|
The status has been granted to 12 countries, including New Zealand, Switzerland and for certified companies, the United States, but negotiations can be lengthy and the power to revoke any agreement remains with the EU. The government said that if it cannot agree an adequacy deal, it could fall back on binding corporate rules or standard contractual clauses.
|
|
"We have a comprehensive offer that we are refining right now, that creates what's called 'essential equivalents' which is the standard that needs to be met in order for Safe Harbor to receive what's called an adequacy determination," said Penny Pritzker, U.S. Secretary of Commerce, summing up the current state of discussions from the U.S. point of view.
|
|
And we want to secure an agreement with the EU that provides the stability and confidence for EU and UK business and individuals to achieve our aims in maintaining and developing the UK's strong trading and economic links with the EU. That is why we will be seeking more than just an adequacy arrangement and want to see an appropriate ongoing role for the UK's Information Commissioner's Office.
|
|
If you look at India for example, who have been trying to get an adequacy agreement with the EU for about ten years, what you've actually found now is a gap between those large multinationals, who can put in place binding corporate rules, standard contractual clauses, have the kind of capital to be able to do that — and it gives them an access to the European market which frankly most smaller businesses don't have from India.
|
|
The committee says the consensus among the witnesses which it took evidence from for the report is that the U.K. needs to secure an adequacy decision from the EU, rather than seeking to rely on other mechanisms — noting for example the U.K. Information Commissioner's view that the country is so heavily integrated with the EU ("three-quarters of the UK's cross-border data flows are with EU countries") that it would be difficult for it to manage without this type of arrangement.
|
|
Under the European Union (Withdrawal) Act 2018, existing and relevant EU law will be transposed into local law upon completion of the transition, and the GDPR will be amended by statutory instrument to remove certain provisions no longer needed due to the UK's non-membership in the EU. Thereafter, the regulation will be referred to as "UK GDPR". The UK will not restrict the transfer of personal data to countries within the EEA under UK GDPR. However, the UK will become a third country under the EU GDPR, meaning that personal data may not be transferred to the country unless appropriate safeguards are imposed, or the European Commission performs an adequacy decision on the suitability of British data protection legislation (Chapter V). As part of the withdrawal agreement, the European Commission committed to perform an adequacy assessment. In April 2019, the UK Information Commissioner's Office (ICO) issued a proposed code of practice for social networking services when used by minors, enforceable under GDPR, which also includes restrictions on "like" and "streak" mechanisms in order to discourage social media addiction, and use of this data for processing interests.
|
|