(1)

Commission Implementing Decision (EU) 2021/1772 (2) concluded that for the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for personal data transferred from the European Union to the United Kingdom within the scope of that Regulation (3).

(2)

When adopting Implementing Decision (EU) 2021/1772, the Commission took into account that, with the end of the transition period provided by the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community (4) and once the interim provision under Article 782 of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (5) would have ceased to apply, the United Kingdom would adopt, apply and enforce a new data protection regime, different to the one in place when it was bound by Union law. As this may have notably involved amendments to the data protection framework assessed in Implementing Decision (EU) 2021/1772 or other relevant developments, it was considered appropriate to provide that that Decision would apply for a period of four years as of its entry into force. Implementing Decision (EU) 2021/1772 is therefore to expire on 27 June 2025, unless it is extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679.

(3)

To decide on a possible renewal of Implementing Decision (EU) 2021/1772, the Commission must assess whether the conclusion that the United Kingdom ensures an adequate level of protection for personal data transferred from the European Union to the United Kingdom remains factually and legally justified. This assessment can only be carried out on the basis of a stable legal framework in place in the United Kingdom.

(4)

The data protection framework assessed in Implementing Decision (EU) 2021/1772, which is based on Union law, continues to apply in the United Kingdom. However, on 23 October 2024 the Government introduced the Data (Use and Access) Bill (6) into Parliament, proposing amendments to the United Kingdom General Data Protection Regulation and Data Protection Act 2018.

(5)

The validity of Implementing Decision (EU) 2021/1772 should therefore be extended for a period of six months in order to allow the Commission to carry out its assessment on the adequate level of protection for personal data provided by the United Kingdom on the basis of a stable legal framework, further to the conclusion of the ongoing legislative process before the United Kingdom Parliament.

(6)

The European Data Protection Board published an opinion (7) which has been taken into consideration in the preparation of this Decision.

(7)

The measure provided for in this Decision is in accordance with the opinion of the Committee established under Article 93 of Regulation (EU) 2016/679,

(8)

Implementing Decision (EU) 2021/1772 should therefore be amended accordingly,