Civil Society Urges EU to Revoke UK Data Adequacy
Seven civil society organisations have urged the European Commissioner to reconsider the UK’s data adequacy status due to increasing concerns over the country’s divergence from European data protection standards. Since the UK was granted adequacy status under the EU’s General Data Protection Regulation (GDPR) and Law Enforcement Directive (LED) in June 2021, there has been a noticeable erosion of privacy and data protection safeguards. These organisations, including European Data Rights (EDRi), Access Now, Statewatch, and Privacy International, argue that the UK’s current data handling practices and upcoming reforms significantly deviate from the EU’s requirements.
The proposed Data Use and Access Bill (DUAB) is particularly criticised for weakening privacy protections. It would reduce the right against automated decision-making, grant UK ministers broad powers to bypass parliamentary scrutiny on data processing decisions, and expand government and law enforcement access to personal data. The bill could also allow data transfers to countries with lower data protection standards, potentially turning the UK into a “data laundering hub.” Other legislative initiatives, such as the Border Security, Asylum and Immigration Bill and the Fraud Bill, raise additional concerns regarding the protection of European citizens’ data.
Concerns extend beyond proposed laws to current data protection enforcement in the UK. The Information Commissioner’s Office (ICO) has been criticised for its limited regulatory action, addressing only one complaint out of over 25,000 in 2024 with legally binding measures. The ICO’s reluctance to investigate issues such as police use of hyperscale public cloud infrastructure, despite evidence of non-compliance with data protection rules, further undermines confidence in the UK’s data protection regime. Additionally, the growing use of live facial recognition technology and secretive Technical Capability Notices to remove encryption raise significant privacy issues.
The civil society groups warn that maintaining unrestricted personal data flows from the EU to the UK while the UK weakens its data protection laws threatens the rights of EU citizens, damages the credibility of the EU’s data protection framework, and exposes EU businesses to unfair competition. They caution that without decisive action, future adequacy decisions could be invalidated by the Court of Justice of the European Union. The groups call on the European Commission to protect data protection standards and prevent the UK from becoming a weak link in the global data protection landscape.
