The long-running saga as to whether the United Kingdom will be considered "adequate" from a data protection point of view has reached an important, and probably welcome to many, point: today, the European Commission has decided that, mostly, the UK offers a sufficient level of protection for European data subjects' personal data to be considered "adequate".

For now, anyway.

What does this mean

The GDPR imposes additional rules on transfers of personal data to countries outside the EEA.

Countries which are considered "adequate" make life easier for both the transferring and receiving organisation, as it means:

• the parties do not need to enter into model contract clauses for international transfers.
  • but you may still need a valid processing agreement, joint controllership arrangement or — not explicitly required but considered good practice by the ICO — a data transfer agreement
• there is no need for a Schrems II assessment as to whether the recipient can offer protection which is "essentially equivalent" to the GDPR.

What it really means, I guess, is that you can spend less money on legal advice or messing around with contracts and technical measures.

Not immigration control

According to the press release:

Transfers for the purposes of UK immigration control are excluded from the scope of the adequacy decision adopted under the GDPR in order to reflect a recent judgment of the England and Wales Court of Appeal on the validity and interpretation of certain restrictions of data protection rights in this area. The Commission will reassess the need for this exclusion once the situation has been remedied under UK law.

You seem a bit hesitant?

I am, because, like Privacy Shield, I expect someone will challenge the decision.

In other words, I would not bet money on the UK remaining "adequate" forever.

And it will be reviewed in four years anyway.

But enjoy it while it lasts and, of course, get in touch if you need a hand with international transfers, or any other data protection issues.