The EU has ruled that UK data protection standards are “adequate” in a decision that means data can continue to flow between the UK and the EU. But Brussels has warned UK government against weakening standards.
A failure to recognise UK standards would have meant chaos in many industries including media and online advertising. The UK’s “adequate” status is guaranteed for four years, but the commission warned it could be withdrawn if UK law was no longer deemed to offer EU citizens protection over how their data was used.
The European Commission said: “The UK has left the EU but today its legal regime of protecting personal data is as it was. Because of this, we are adopting these adequacy decisions today […] We are talking here about a fundamental right of EU citizens that we have a duty to protect. This is why we have significant safeguards and if anything changes on the UK side, we will intervene.”
During the Brexit transition UK government largely copied key EU legislation, notably the key General Data Protection Regulation (GDPR) and the Law Enforcement Directive, which governs data sharing in police and law enforcement.
Brexiteer Tories had pressed to ditch the “prescriptive and inflexible” GDPR.