Ms Nicola Coogan:

The four-year period is very important because while the other decisions are reviewed, they are perpetual decisions. Reviews are built into the GDPR but this is unusual in that it ends after four years and the whole process has to be done again to renew. It is not just simply a case of the European Commission conducting an assessment. It will be brought back to the EDPB and will go through the comitology procedure again. That is dissuasive for divergence in the law. The UK will want this to be renewed. If there is any fear of it not being renewed, that will have huge repercussions for businesses and for public sector bodies as well because it is not just businesses that are transferring data across to the UK. The four-year provision is unusual. The draft decision says that the European Commission has a role in monitoring but it also calls on the supervisory authorities or any body to draw attention to any concerns they may have about something in the law or something in a case, on foot of which the decision can be paused, suspended or completely repealed at any time.