The Opinion on the UK Government’s Assessment of Adequacy Has Been Published by ICO

ICO (the Information Commissioner’s Office) published an Opinion on the assessment of the adequacy of the UK Government (“Government”) for the UK Extension to the EU-US Data Privacy Framework for the general processing of personal data.

The Government can assess whether another country, territory or an international organization provides an adequate level of data protection compared to the UK. Some countries may have a substantially similar level of data protection to the UK. In these cases, the Government can make UK adequacy regulations. The Government must consider a range of factors, including that sending personal data to that country, territory, or international organization does not undermine people’s protection.

ICO states that they support the Government undertaking adequacy assessments and making regulations: “This enables personal data to flow freely in our global digital economy to trusted partners.”

As set out in the ICO25 strategic plan, one of the priorities of ICO was to “enable international data flows through regulatory certainty” which includes the work on adequacy assessments. ICO provided advice to the Government during its assessment of the UK Extension to the EU-US Data Privacy Framework (UK Extension). As the Government has laid the regulations, ICO published its Opinion on the process and conclusion.

ICO deems that “This Opinion is primarily for members of the UK Parliament to consider alongside the UK adequacy regulations laid by the Secretary of State. It may also interest the wider public, data protection professionals and organizations that already transfer personal data to the United States of America (USA) or who are considering doing so.”

The UK’s data protection laws set out a framework for the responsible use of personal data by organizations. These rules mean that organizations must put in place continuing protections for people’s personal data when transferring it to another jurisdiction, or one of a limited number of exemptions must apply.

If the Secretary of State decides the country, territory, international organization, or a particular sector in a country or territory, provides an adequate level of data protection after considering all the criteria which are stated in the full text of the Opinion of the ICO, they can make regulations to give legal effect to their decision.

You can access the full text of the Opinion here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr