The uk-eu relationship in financial services

Notwithstanding the inevitability of UK-EU divergence on the details 
of financial services regulation, and the opportunities this is likely 
to afford the UK’s financial services sector, in the long-term, the 
Committee considers that there is a strong case for pursuing global 
convergence on the principles and outcomes of the regulation of 
financial services.
Data adequacy
201. As part of its examination of the impact of potential regulatory divergence on 
the financial services sector, the Committee’s inquiry examined the future of 
the current UK-EU data adequacy arrangements (explained in Box 2 below), 
in the context of the Government’s plans for reform of its data protection 
regime, and the impact thereof on the UK financial services sector.
202. The Government has indicated that it sees diverging from inherited EU data 
protection laws as one of the opportunities of Brexit. The Government’s 
‘Benefits of Brexit’ report, published on 31 January 2022, set out its 
intention to establish a “new pro-growth data regime” which would “help 
to drive growth, innovation and competition across the country”.
254
In the 
Queen’s Speech on 10 May 2022, the Government announced that it would 
be bringing forward a Data Reform Bill, which will “take advantage of the 
benefits of Brexit to create a world class data rights regime that will allow us 
to create a new pro-growth and trusted UK data protection framework”.
255
Box 2: Data adequacy explained
Personal data transfers from the EU to third countries, such as the UK, are 
governed by the 2016 General Data Protection Regulation (GDPR). Under 
GDPR, the EU Commission may unilaterally grant an ‘adequacy’ decision 
confirming that a third country provides a comparable level of data protection 
to that in EU law. This allows cross-border transfers of personal data from the 
EU to the third country without additional safeguards.
256
The EU did not immediately grant the UK data adequacy following the end of 
the transition period, but the TCA contained a temporary bridging mechanism 
allowing for the continued free flow of personal data from the EU to the UK, 
conditional on the UK maintaining its existing levels of data protection and for 
a period of up to six months.
257
254 Cabinet Office, 
The benefits of Brexit: how the UK is taking advantage of leaving the EU
(31 January 
2022): 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/
file/1054643/benefits-of-brexit.pdf
[accessed 7 June 2022]
255 Prime Minister’s Office, 10 Downing Street, 
Queen’s Speech 2022
(10 May 2022): 
https://assets.
publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1074113/
Lobby_Pack_10_May_2022.pdf
[accessed 7 June 2022]
256 
European Commission, ‘Adequacy Decisions’: 
https://ec.europa.eu/info/law/law-topic/data-
protection/international-dimension-data-protection/adequacy-decisions_en
 [accessed 7 June 2022]
257 Trade and Cooperation Agreement between the European Union and the European Atomic Energy 
Community, of the one Part, and the United Kingdom of Great Britain and Northern Ireland, of the 
other Part, Article 782, 
OJ L 149
, 30 April 2021

---

51
THE UK-EU RELATIONSHIP IN FINANCIAL SERVICES
On 28 June 2021, the European Commission adopted two data adequacy 
decisions, replacing the bridging mechanism in the TCA and allowing transfers 
of personal data from the EU to the UK to continue on a more long-term basis. 
One decision addressed data sharing on the basis of the EU’s General Data 
Protection Regulation, the other via the EU Directive on the transfer of data for 
the purposes of law enforcement.
258
These adequacy decisions can, however, be withdrawn at any time—a credible 
scenario, given the recent case law of the Court of Justice of the European Union 
(CJEU) on data privacy matters.
259
The adequacy decisions also automatically 
expire after four years, with any renewal contingent on whether the EU still 
deems the UK to have an adequate system of data protection in place. In his 
evidence to the Committee, the Economic Secretary described the adequacy 
arrangements as “strong” but acknowledged that they were “not an enduring, 
permanent recognition”.
260
EU data adequacy decisions cover personal data transfers from the EU to the 
UK. Transfers in the other direction—from the UK to the EU—are not affected 
by this process. The UK Government has already implemented provisions 
permitting the transfer of personal data from the UK to the EEA.
261
203. The UK-EU data adequacy arrangements are important for services providers 
involved in cross-border transfers of personal data, including some in the 
financial sector—particularly those in retail businesses who are involved in 
the handling of their customers’ data. In evidence to the former EU Services 
Sub-Committee’s report,