Lords committee warns about risks of the UK losing its EU data adequacy

British businesses and public sector organisations are at risk of facing significant additional costs if the UK loses its ability to smoothly transfer data to the European Union (EU), according to a cross-party House of Lords committee.

In June 2021, the European Commission granted “data adequacy” to the UK after its departure from the EU, allowing the unrestricted flow of personal data to and from the EU to continue. However, there is a warning that this decision could be reversed if future data protection laws in the UK diverge significantly from those in Europe.

As the UK became a “third country” under the EU’s regulations upon exiting the EU, the European Commission will need to regularly assess whether the UK maintains an essentially equivalent level of data protection for data belonging to EU citizens.

By the end of June 2025, the European Commission will have to make two separate adequacy determinations under the EU’s General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED), both of which were integrated into UK law through the Data Protection Act 2018.

Following a seven-month inquiry into the UK’s EU data adequacy, the European Affairs Committee (EAC) has written to the digital secretary Peter Kyle, urging the government to initiate early discussions with the EC to ensure that the UK maximizes its chances of securing a data adequacy agreement in the first half of 2025.

The committee highlighted the potential consequences of losing adequacy status, including creating new obstacles to international trade and economic cooperation, imposing additional costs and administrative burdens on organizations that share data between the UK and the EU (especially in areas like policing and healthcare), and the risk of disrupting the Good Friday Agreement.

Additionally, the EAC pointed out the substantial financial implications of losing adequacy, stating that while GDPR compliance itself can be costly, the loss of data adequacy could result in significant financial penalties for many organizations.

For instance, estimates suggest that the NHS alone could face costs amounting to tens of millions of pounds if adequacy is lost, and UK businesses could incur additional compliance expenses ranging from £1 to £1.6 billion if adequacy status is not secured.

The EAC emphasized the value of adequacy in reducing administrative burdens and compliance costs, enhancing legal certainty, and making the UK a more appealing location for investment and business operations.

Committee chair Lord Ricketts warned of a potential cliff-edge situation in June 2025 if an agreement is not reached with the EU to maintain the free flow of data. He stressed the importance of data exchange in supporting trade, economic ties with the EU, and collaboration between law enforcement agencies.

To address the uncertainty surrounding its future adequacy status, the EAC recommended that the government engage with the European Commission and other EU stakeholders early on to ensure a positive trajectory for the adequacy renewal process and provide reassurance promptly regarding the retention of adequacy status.

The committee also advised the government to explore the possibility of securing future adequacy renewals from the European Commission that do not expire after a fixed period and to engage with the EU in a timely manner to explain and offer reassurances on any planned data protection reforms.

In response to Computer Weekly’s request for comment on the EAC’s letter, a DSIT spokesperson stated that the science secretary has held discussions with EU commissioner Reynders regarding the upcoming EU personal data adequacy review of the UK and ensuring the secure continuity of personal data flows from the EU to the UK. Officials will participate in technical discussions with EU counterparts as needed to support the review process.