Data Protection: EDPB asks EU to "dig deeper" into UK law

European Data Protection Board is seeking a more detailed EU Commission review into UK data rules before renewing the EU adequacy decision, which is due to expire at the end of December

The Key Points: The European Data Protection Board (EDPB) has advised the European Commission to conduct more detailed review of UK data protection changes before renewing the UK adequacy decision, which expires in December 2025. The EDPB flagged concerns about the Data Use and Access Act's impact on recognised legitimate interests, automated decision-making, and onward data transfers to third countries. While broadly welcoming continued alignment, the EDPB called for greater clarity on ICO's new powers and encryption backdoors.

Why This Matters: The adequacy decision enables European bodies to transfer data to UK entities without additional guarantees, making it crucial for post-Brexit business operations. The EDPB's concerns about the UK's new adequacy test removing important protective elements could signal stricter requirements for future data transfers. Changes to automated decision-making rules remain untested in practice, creating uncertainty for businesses relying on algorithmic processes.

What Might Happen Next: The European Commission must address EDPB concerns before finalising the UK adequacy decision renewal by December 2025. Enhanced monitoring of UK data protection practices will likely continue, particularly around government access risks and individual redress mechanisms. Future adequacy assessments may face stricter scrutiny as the EDPB pushes for more comprehensive evaluations.

What You Should Be Doing: Companies should prepare contingency plans for potential adequacy decision changes or delays beyond December. Review current UK data transfer arrangements and ensure alternative protective measures are available if adequacy status changes. Monitor developments in UK automated decision-making rules and assess compliance requirements for AI and algorithmic systems operating across EU-UK boundaries.

See full EDPB statement and opinion