We drew attention recently to the fact that European Commission was expected to issue a draft decision conferring "adequacy" status on the UK, for the purposes of transfers of personal data from the EU to the UK.
The draft decision was published a few days later than expected, on 19 February (and at the same time a separate draft decision also conferring adequacy was also published, in respect of law enforcement processing of personal data).
There is still a way to go before the decisions are given final approval - the European Data Protection Board must first scrutinise them, and then a committee of representatives of EU member states must vote, but the signs are clearly pointing towards adequacy status before the six-month bridging period allowed for by the Trade and Cooperation Agreement expires.
The nature of adequacy agreements is that they require states in receipt of them to maintain broad convergence with EU data protection law, but it is worth noting that, in addition to this, Věra Jourová, Vice President of the European Commission for Values and Transparency warned that "any problematic development of the UK system" might lead to suspension or withdrawal of the decision.
And as discussed in the previous article on this topic, "it is quite possible that any final decision could be challenged before and by data protection regulators, and, ultimately, such challenges may end up in the European Court of Justice (or the High Court in the UK). Such challenges, which are certainly likely to be considered by civil society groups, may well turn on questions regarding the extent to which the UK's surveillance regime could be said to be in conflict with data protection law".