Question for written answer E-000576/2021 to the Commission Rule 138 Gwendoline Delbos-Corfield (Verts/ALE), (Verts/ALE), (Verts/ALE), (Verts/ALE), (Verts/ALE), Sergey Lagodinsky (Verts/ALE), Damien Carême (Verts/ALE), (Verts/ALE)

Subject: Data adequacy assessment for the UK and the right to privacy (1), including a 4(+2)‑month temporary extension for transfers of personal data

The Court of Justice of the (CJEU) judgment on Schrems II1 set out the data protection standards a third country needs to adhere to, including the elimination of mass surveillance laws, to be granted an adequacy decision.

1. Has there been an assessment of the UK’s data protection laws and practices, including the definition of personal data and the documented mass surveillance practices of GCHQ (Government Communications Headquarters)? Has this been carried out after consultation with the UK Government on its future legislative plan, and if so, when will this be publicly available?

2. If not, why does the Commission assume the legislative plan will fulfill the conditions set out by the CJEU in the two Schrems judgments?

3. If the UK diverges from the EU’s high standards of data protection through future changes in UK data protection law, how will the Commission ensure it can react within five days2, and is such an approval procedure consistent with the provisions in the EU data protection acquis, Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 of the Treaty on the Functioning of the European Union? How will data subjects be able to seek remedy if they are victims of data protection violations related to the transfer of data to the UK occurring during this period?

1 http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=en&m ode=lst&dir=&occ=first&part=1&cid=12312155 2 paragraphs 9 and 10 of Article FINPROV.10A

PE685.822v01-00