Answer given by Mr Reynders on behalf of the European Commission
2.8.2023
Having adopted adequacy decisions for the United Kingdom (UK) under Article 45(3) of the General Data Protection Regulation[1] and Article 36(3) of the Law Enforcement Directive[2], the Commission is required to monitor, on an ongoing basis, relevant developments in the UK to assess whether it still ensures an essentially equivalent level of protection for personal data.
In the context of that obligation, the Commission has been in regular contact with representatives of the UK Government since the early stages of the UK’s reform of its data protection legislation.
These contacts have been helpful for a better understanding of the content and scope of the amendments proposed in the Data Protection and Digital Information Bill.
While a number of those amendments are aimed at clarifying the existing framework, some specific proposals would — if adopted — raise questions with respect to the level of protection.
This is, for example, the case for the amendments that would affect the independence of the UK’s data protection authority, the Information Commissioner, as well as for the proposal to give to the Secretary of State the power to recognise in the future certain interests of the data controller as a legal basis for processing (so-called ‘legitimate interests’) without any limitation and without the need for a balancing against the rights and interests of the individual.
The Commission has repeatedly raised these concerns with the UK Government and will continue to closely monitor how the Bill evolves in the parliamentary process.
- [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance), OJ L 119, 4.5.2016, p. 1.
- [2] Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89 .