The European Data Protection Supervisor has issued an opinion on the new partnership to be agreed between the EU and the UK after the transition period ends.
On 3 February 2020, the European Commission adopted a Recommendation for a Council Decision authorising the negotiations for a new partnership between the EU and the UK. On 12 February 2020, the European Parliament adopted a Resolution on the proposed mandate.
Such a partnership would be composed of three main parts:
- general arrangements (including provisions on basic values and principles and on governance);
- economic arrangements (including provisions on trade and level playing field guarantees); and
- security arrangements (including provisions on law enforcement and judicial cooperation in criminal matters, as well as on foreign policy, security and defence).
The EDPS welcomes and supports the objective of the European Commission to conclude a comprehensive partnership with the UK, establishing a cooperation the essential elements of which should be in particular the respect for and safeguarding of human rights as well as the rule of law, affirming the parties’ commitment to ensuring a high level of personal data protection and fully respecting the EU’s personal data protection rules.
In view of the close cooperation that is expected to continue between the EU and the UK at the end of the transition period, the EDPS also welcomes and supports the European Commission’s commitment in its Recommendation to work towards the adoption of adequacy decisions, provided that the relevant conditions are met.
The EDPS aims to providing constructive and objective advice in relation to the envisaged partnership and the adequacy assessment. Its key recommendations in relation to the envisaged partnership are:
- ensuring that the security and the economic partnerships are underpinned by similar commitments to respect fundamental rights, including adequate protection of personal data;
- defining priorities where arrangements for international cooperation should be concluded in matters other than law enforcement, in particular for the cooperation between public authorities, including the EU.
On the assessment of adequacy, the EDPS raises the following points:
- the importance of such assessment under the Law Enforcement Directive 2016/680/EU and the GDPR for cooperation between public authorities and its impact on transfers by EU institutions, bodies, offices and agencies to the UK;
- the importance of defining the scope of the envisaged adequacy decisions, in particular under the Law Enforcement Directive;
- the adoption of an adequacy decision is subject to specific conditions and requirements and, if the European Commission presents a draft adequacy decision, the European Data Protection Board should be appropriately involved in a timely way;
- given the specific situation of the UK, any substantial deviation from the EU data protection acquis that would result in lowering the level of protection would constitute an important obstacle to the adequacy findings.
The EDPS’ final recommendation is that the EU take steps to prepare for all eventualities, including where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.
