19 January 2024
The European Commission has successfully concluded its review of eleven adequacy decisions adopted under the EU data protection legislation that preceded the General Data Protection Regulation. As a result, personal data transferred from the European Union to the eleven countries and territories the subject of the adequacy decisions continues to benefit from adequate data protection safeguards.
On 15 January 2024, the European Commission (the “Commission”) concluded its review of eleven existing adequacy decisions regarding the transfer of personal data from the European Union (“EU”) to eleven third countries and territories.
Adequacy status is conferred on a country that is not a member of the European Union when its level of data protection corresponds to the level of protection of personal information adhered to in the countries of the EU and the European Economic Area. Adequacy decisions help to enable safe data flows, remove the need for detailed and complex transfer mechanisms and open up commercial channels for EU operators.
In its report regarding the functioning of eleven adequacy decisions, the Commission found that Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay continue to ensure an adequate level of protection for personal data transferred from the EU within the scope of the General Data Protection Regulation (“GDPR”). Therefore, data can continue to flow freely to these jurisdictions from the EU.
The GDPR requires the Commission to conduct periodic reviews of adequacy decisions. The eleven adequacy decisions had originally been adopted under the 1995 Data Protection Directive, the precursor to the GDPR. With the entry into force of the GDPR in 2018, the Commission was required to analyse the eleven decisions to determine whether the countries and territories continued to provide an adequate level of protection of personal data given that adequacy decisions are “living instruments” requiring ongoing monitoring by the Commission.
This stipulation had instigated detailed exchanges between the Commission and the eleven countries and territories concerned on relevant aspects of their legal frameworks, oversight mechanisms and enforcement systems as it relates to personal data.
The Commission has found that since the adoption of the original adequacy decisions, the eleven countries and territories have carried out a comprehensive modernisation of their privacy legislation.
Specifically, the Commission determined that legislative amendments and the activities of oversight bodies had contributed to an increased level of data protection in the eleven countries and territories whilst the development of case law in a number of the jurisdictions had also developed protections in this area.
The review also found that public authorities in each of the countries and territories are subject to clear, precise and accessible rules under which such authorities can access and subsequently use for public interest objectives, in particular for criminal law enforcement and national security purposes, data transferred from the EU. The review also revealed that in the eleven jurisdictions, there are suitable safeguards in place concerning public authorities’ access to personal data including effective oversight and redress mechanisms.
On the basis of its findings, the Commission concluded that the eleven countries and territories continue to provide an adequate level of protection for personal data transferred from the EU. The Commission will continue to closely monitor developments in the protection frameworks and actual practice of the countries and territories concerned as required under the GDPR. In this regard, the Commission has recommended that protections that have been developed at sub-legislative level and by case law in the countries and territories be enshrined in legislation.
The Commission’s determination will provide comfort to businesses in the EU who rely on transfers of personal data to the eleven countries and territories. The Commission’s determination will also enhance the economic competitiveness of the eleven countries and territories as desirable business locations for EU operators.
If you have any queries about personal data regulations, contact our Data Privacy team below. We look forward to hearing from you.
