The European Commission has proposed to extend the two adequacy decisions for the UK (which permit the free flow of data from the EU to the UK) until 27 December 2025 – the current decisions expire on 27 June 2025. The draft extension decisions will now be transmitted to the European Data Protection Board for its opinion, as part of the adoption procedure.
It appears that the Commission is waiting for the Data (Use and Access) Bill (the ‘DUA Bill’), which seeks to make various changes to the scope of data protection law in the UK (see our commentary here) to come into force before making any further decisions on the UK’s adequacy status. There has been some commentary that the proposed changes under the DUA Bill will undermine the UK’s adequacy status, which could result in companies needing to implement alternative measures to transfer data from the EU to the UK, but this has not been confirmed. We will continue to monitor the status of the UK’s adequacy decisions and any further commentary from the European Commission in relation to the Commission’s future approach to data transfers to the UK.
