European Commission adopts UK Adequacy Decision
On June 28, 2021, the European Commission has adopted two adequacy decisions for transfers of personal data to the United Kingdom, one under the General Data Protection Regulation (“GDPR”) and the other for the Law Enforcement Directive (“LED”).
The GDPR and LED impose restrictions on the transfer of personal data to a ‘third country’ unless that country benefits from (i) an adequacy decision; (ii) appropriate safeguards (e.g. standard contractual clauses (SCCs)); or (iii) one of the limited exceptions under Article 49 GDPR.
The UK adequacy decisions have been adopted just in time – the six month ‘bridging period’ agreed under the UK – EU Trade and Cooperation Agreement, allowing personal data to be transferred from the EU to the UK without the need for any additional safeguards, expired on 30 June 2021. The adopted adequacy decision will allow personal data to continue to flow to the UK from the EU.
EDPB adopts final Guidelines on the concepts of Controller and Processor, the Guidelines on virtual voice assistants and new Guidelines on codes of conduct as transfer tool
On 8 July 2021, the European Data Protection Board (EDPB) announced the outcomes of its plenary session that took place on 7 July.
During the plenary session, the EDPB adopted new Guidelines on codes of conduct as a tool for transfers (the Guidelines on COC). The EDPB explains that the Guidelines on COC seek to clarify the application of Articles 40(3) and 46(2)(e) GDPR. These provisions stipulate that codes of conduct, after having been approved by a competent supervisory authority and granted general validity within the EEA by the European Commission, may also be used, and adhered to, by controllers and processors that are not subject to the GDPR, in order to provide appropriate safeguards for transfers of data outside of the EEA.
The EDPB also adopted a final version of the Guidelines on the concepts of Controller and Processor. The final version incorporates further clarifications of the concepts of controller, joint controllers and processors following public consultation.
In addition, the EDPB adopted a final version of the Guidelines on Virtual Voice Assistants (the Guidelines on VVA), that aim to assist relevant stakeholders on how to address a series of compliance challenges for virtual voice assistants.