The UK government and ICO agree on a process for future adequacy decisions
On March 19, 2021, the Secretary of State for Digital, Culture, Media and Sport (“DCMS”) signed a Memorandum of Understanding (“MoU”) with the Office of the UK Information Commissioner (“ICO”) on the new UK Post-Exit Adequacy Assessment Great Britain from the European Union. The MoU specifies how DCMS and third countries will negotiate adequacy decisions, which are referred to in the MoU as “Adequacy Provisions”. These allow personal data collected in the UK to be transmitted free of charge to the appropriate “appropriate” jurisdiction.
The UK has adopted the European Commission’s existing pre-Brexit adequacy decisions, for example in relation to Argentina, Israel and New Zealand, but will determine future UK adequacy decisions. Although these decisions are the responsibility of the Secretary of State, the secretary must consult the ICO (and any other person he deems appropriate) before making such a decision. DCMS and ICO need to work closely together and exchange expertise and information from the Memorandum of Understanding. Ultimately, however, DCMS is not bound by the views of the ICO in its decisions.
The MoU defines the four phases in which DCMS will carry out its adequacy work, beginning with gatekeeping, the process by which a specific team within DCMS will examine whether an assessment of a third country should be initiated for adequacy purposes. This phase is followed by an assessment (based on the requirements of Article 45 of the GDPR), a recommendation to the Foreign Minister and finally a procedural phase in which the adequacy provisions are drawn up and presented to Parliament. The ICO and DCMS are expected to meet for discussion at different intervals during this process.
After signing the MoU, the UK government stated that it “intends to expand the list of suitable travel destinations in line with our global ambitions and commitment to high data protection standards”.
Read the ICO press release and letter of intent.