However, despite the absence of any meaningful progress, the European Parliament's Committee on Civil Liberties, Justice and Home Affairs has raised concerns about the current form of the Bill, as part of a wide-ranging report on the EU-UK Trade and Cooperation Agreement.

Highlighting the expiration in 2025 of the two adequacy decisions for the UK, the Committee documented the power of the European Commission to intervene where deviation from existing levels of data protection occurs. The report invites the Commission to "closely scrutinise the impact of the DPDI2 has on the data protection rights of EU citizens."

The inclusion of "general and broad exemptions" from data protection principles and data subject rights for immigration purposes are a source of disquiet; proposed delegated legislative powers to allow the legalisation of data processing for national security, law enforcement and public authorities' access to personal data held by private entities are also flagged.

The comments of the Committee reaffirms existing concerns over the risk posed to the UK-EU adequacy agreement by the DPDI (No.2) Bill. During the House of Commons committee stage, the Information Commissioner, John Edwards, was questioned whether he believed the Bill would put the UK's data adequacy recognition from the EU at risk. He did not believe "that there is a realistic prospect of the Commission reviewing negatively the adequacy determination" as the essential features of the existing UK GDPR were present in the Bill.

The concerns raised by the European Committee on the existing form of the Bill are likely to generate discussion during the forthcoming report stage in the House of Commons. We will await those debates with great interest.

Latombe challenge to Data Privacy Framework

In our October bulletin, we discussed the challenges to the adequacy decision on the Data Privacy Framework by the French MEP, Philippe Latombe. Mr Latombe had sought the suspension of the data adequacy decision on the Data Privacy Framework, and filed proceedings against the European Commission, also seeking payment of his costs.

The application for an annulment was rejected on 12 October by the General Court of the European Union (judgment via French language website).

The judgment concluded that Mr Latombe failed to demonstrate the urgency required for the annulment sought. Any alleged damage that he suffered was described only in general terms when he was actually required to demonstrate that he would personally suffer serious harm as a result of the adequacy decision. In addition, Mr Latombe failed to explain how the adequacy decision would put him at a disadvantage compared to the prior situation.

Despite this, we expect that further challenges by privacy advocates to the Data Privacy Framework will be brought, and we will provide updates in due course.