The Commission requested the EDPB’s opinion on the basis of the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED), the previous equivalence decision of which expires in December 2025. The extension of the validity of the equivalence decision will allow institutions and companies to continue to transfer personal data to the United Kingdom on that basis, without any further measures.

The EDPB considered that some aspects of the drafts required further consideration, including the powers of officials (in particular the Secretary of State), the UK rules on the adequacy assessment of third countries and changes to the structure and powers of the UK Information Commissioner’s Office (ICO), among others. In addition, the EDPB specifically notes the more open approach to automated decision-making and the importance of human intervention.

The EDPB welcomes the fact that the supervision system for law enforcement authorities remains largely unchanged. However, similar comments are made, for example, with regard to the transfer of personal data to third countries as well as automated decision-making, and the importance of human intervention is emphasised. The Council points out that it is necessary for the Commission to closely monitor the application of the new powers and the remedies available to individuals under the UK Data Protection Regulation.

See further on EDPB website.