EU Commission’s review of existing adequacy decisions well underway

The EU Commission’s review of the existing adequacy decisions, which started two years ago, is due to be completed by May 2020 when the Commission will report to the EU Parliament and Council. Speaking at Privacy Laws & Business 32nd Annual International Conference yesterday, Bruno Gencarelli, Head of International Data Transfers and Protection Unit at the EU Commission, said that the Commission has asked the countries in question to update the Commission on any legislative changes and enforcement of their existing laws. The second series of questions from the Commission has addressed issues around access to personal data by law enforcement and national security agencies.

Gencarelli said that the Commission is looking for ‘essential equivalence’ as determined by the Court of Justice of the European Union, not an identical system to the GDPR. The aspects that are important include individual rights, and importantly, how the law is being enforced.

He said that the negotiations with Korea, which has applied for an adequacy decision, are at an advanced stage. One of the remaining issues, independence and enforcement powers of the DPA, is being addressed by an Amendment Bill which is pending in Korea’s National Assembly.

There is no special order in which the Commission will review the existing adequacy decisions, or a queue of new applicant countries, Gencarelli said. Future candidates could include Brazil and Chile. When asked whether the Commission would suspend existing decisions due to an unsatisfactory review, Gencarelli said that he cannot rule out these types of measures but stressed that the Commission aims at continuity.

Negotiations with Japan, which now has a mutual adequacy decision with the EU, took two years, Gencarelli revealed. One of the trickiest aspects was onward transfers – an aspect that would also be a ’sensitive issue’ in a possible UK adequacy application.