EDPB backs UK adequacy extension under GDPR but urges strict monitoring
The European Data Protection Board (EDPB) adopted two opinions on the European Commission’s draft decisions to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) until December 2031. The Commission requested the six-year extension to maintain the free flow of personal data from the EU to the UK without additional transfer safeguards, since the current adequacy decisions expire in December 2025. EDPB Chair Anu Talus welcomed continued alignment between EU and UK data protection frameworks while urging the Commission to address the Board’s concerns and to ensure rigorous monitoring once the decisions are adopted to strengthen legal certainty.
In its GDPR opinion the EDPB recognised that recent UK legal changes often aim to clarify compliance, but identified areas requiring close monitoring. These include the Retained EU Law (Revocation and Reform) Act 2023 — notably the removal of EU law primacy and direct effect — and expanded executive powers that could change rules on international transfers, automated decision-making, and Information Commissioner’s Office (ICO) governance with limited parliamentary scrutiny. The Board also highlighted the UK’s new adequacy test for transfers to third countries as lacking explicit assessment of government access risks, redress mechanisms, and independent supervision, and raised concerns about Technical Capability Notices (TCNs) that might be used to bypass encryption.
Concerning LED matters, the EDPB welcomed legislative alignment in the law enforcement context but flagged specific risks. The Board called attention to national security exemptions that could override data protection principles and limit oversight, and urged that rules on international data transfers for law enforcement be assessed with the same rigor applied under the GDPR. The EDPB also expressed concern about a more permissive approach to automated decision-making and stressed the need to preserve individuals’ rights to human review, while monitoring redress mechanisms and the effective exercise of corrective powers in the UK framework.
Overall, the EDPB reaffirmed key findings from its 2021 adequacy opinions, noting that core rights and obligations under the GDPR — including transparency and data subject rights — remain closely aligned between the EU and the UK. The Board’s opinions ask the Commission to address identified gaps and set out robust monitoring and enforcement arrangements to ensure continued protection of personal data transferred to the UK through the proposed extended adequacy decisions.
