The European Commission has proposed a six-month extension of its two data adequacy decisions for the UK (both of which are set to expire on 27 June 2025). This extension would move the deadline to 27 December 2025.
Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law, and Consumer Protection at the European Commission, stated that:
"The adequacy decisions are key to our relationship with the UK. They ensure data can flow freely and safely, which is crucial for trade, justice, and law enforcement cooperation. Our proposal will allow the Commission to assess whether to renew these decisions based on a stable legal framework, while keeping data flows to the UK uninterrupted."
This tone contrasts with the run-up to the initial adequacy decisions a few years ago, during which the EU and UK were preoccupied with numerous other issues amidst the Brexit negotiations and organisations were preparing for the possibility that the UK would not be granted adequacy (remember the absurdity of 'access for fishes for data adequacy' and similar).
Why delay at all?
The UK's third attempt at new data protection legislation, the Data (Use and Access) Bill, continues to progress through the legislative process, and it is likely to become law well ahead of the new December deadline proposed by the European Commission.
Chris Bryant, (Minister of State for Data Protection and Telecoms), recently indicated that the Bill was in its final stages and anticipated its completion "by Easter or a couple weeks after" and also believes that the new Bill will meet the EU's adequacy requirements.
It seems therefore that the European Commission's proposed decision is to avoid giving adequacy decisions before the imminently expected new law is introduced.
Next steps
Considering that the Data (Use and Access) Bill is nearing its final stages and the apparent positive sentiment from Europe, it appears unlikely that there will be any significant obstacles to data flows from the UK to the EU.
We therefore expect that once the Bill becomes law, the European Commission will undertake its formal review process to assess the adequacy of the UK's data protection framework; and hopefully shortly thereafter as a 2025 Christmas present, adequacy is renewed.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
