13 June 2023 Letter to Commissioner Reynders from LIBE Committee Chair DPDI Bill

Dear Commissioner Reynders,

On 23 May 2023, LIBE committee Members held an exchange of views with the UK Information
Commissioner, Mr John Edwards, which was organised as follow-up to the LIBE committee’s
mission to the United Kingdom in November 2022.

During the exchange of views in the LIBE committee, Members raised their concerns with regard
to draft Data Protection and Digital Information Bill, which is currently being considered by the UK
Parliament, and its possible impact on the UK adequacy findings, both under the General Data
Protection Regulation (GDPR) and the Law Enforcement Directive (LED).

At their meeting on 30 May 2023, and in light of the discussion with the UK Information
Commissioner, LIBE Coordinators decided to request the Commission’s appraisal of the draft law
in question.

I would be very grateful, therefore, if you could provide me with the Commission’s current
assessment of whether the draft Data Protection and Digital Information Bill respects the
principles, rights and obligations of the GDPR and the LED, in particular whether the draft Bill
meets the requirement of “essential equivalence” as established by the Court of Justice in case
C-311/18 Schrems II.

Let me point out that LIBE Members have expressed particular concerns about the independence
of the new Information Commission to be established, including with regard to the appointment
and dismissal procedures of its non-executive members, the new powers of the UK government,
including with respect to setting of strategic priorities, and the approval of codes of practice. They also pointed out that e.g. already now the ICO guidelines on international data transfers depart
from the CJEU case law and the approach of the European Data Protection Board. Finally, LIBE
Members have stressed that in the UK the new Bill is presented as a departure from the EU
overregulation, cutting down bureaucratic requirements imposed by the EU, while in Brussels, it
is presented as a minor “modernization”, which introduces changes that do not depart from the
EU acquis. Both of the above statements cannot be true.

We are aware that the work on the draft Bill is still ongoing and that Commission has time until
June 2025 to re-assess the UK adequacy under both the GDPR and the LED. At the same time,
when answering questions from LIBE Members, Mr John Edwards stressed that he is in touch
with the Commission and highlighted the importance of the ICO’s connection with you and your
team. Knowing that DG Justice is following the developments related to the Bill very closely and
that you are in constant touch with your UK counterparts, we would appreciate your preliminary
assessment of the situation and the draft Bill as it was introduced by the UK government.

Yours sincerely,
Juan Fernando López Aguilar