During its latest plenary, the European Data Protection Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED). It also adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO). Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina.
Six-month extension of the UK adequacy decisions
The EDPB opinion was requested by the European Commission. It addresses the proposed extension of the two UK adequacy decisions under the GDPR and the LED (not the substantive issue for adequacy of the UK regime) which are set to expire on 27 June 2025.
As the UK‘s data protection reform via the Data (Usage and Access) Bill is still pending in the UK parliament, the EDPB recognises the need for a technical and time-limited extension of the adequacy decisions until 27 December 2025.This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.
The EDPB stresses that this extension is exceptional and is due to the ongoing legislative developments in the UK. It says that it should not, in principle, be further prolonged.
Adequate protection of personal data by the EPO
At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region.
In its opinion, the Board positively notes that the EPO data protection framework is largely aligned with the European Union data protection framework, including on data protection rights and principles. It says that this shows that the GDPR and, in particular, its transfer provisions, can facilitate safe data flows from Europe to international organisations, while taking into account their status.
New observer to the EDPB’s activities
Finally, EDPB members agreed to grant observer status to the EDPB’s activities to the Bosnia and Herzegovina Data Protection Authority, under Article 8 of the EDPB Rules of Procedure.
