EU retains all existing adequacy decisions

The European Commission has finally issued its Report on the evaluation of the existing 11 adequacy decisions under the 1995 Data Protection Directive. The Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay continues to benefit from an adequacy decision.

“The review has demonstrated that the data protection frameworks in these countries and territories have further converged with the EU's framework and strengthened protection of personal data in their jurisdictions,” the Commission says.

The Commission mentions that these reforms reinforced, for example, the independence and enforcement powers of Data Protection Authorities. However, some reforms are still ongoing, for example in Canada (on the Personal Information Protection and Electronic Documents Act PIPEDA). Similarly, Israel’s Privacy Protection Bill (Amendment No. 14) is still in Parliament.

The Commission says that its findings promote convergence between privacy systems based on high standards of protection. Rather than being an ‘end point’, adequacy decisions have laid the foundation for closer cooperation. To this end, and to step up dialogue, the Commission intends to organise a high-level meeting in 2024, bringing together representatives from the EU and all countries that benefit from an adequacy decision.

See: The Commission’s Report of 15 January and country reports

In the next issue of PL&B International Report, Professor Graham Greenleaf analyses The Dubai International Financial Centre’s adequacy decision regarding the California Consumer Privacy Act of 2018, and the challenges in international data transfers in general.