Commission finds that EU personal data flows can continue with 11 third countries and territories

This article is brought to you in association with the European Commission.

Today, the European Commission successfully concluded its review of 11 existing adequacy decisions. These decisions had been adopted under the EU data protection legislation that preceded the General Data Protection Regulation (GDPR). In its report, the Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay, continues to benefit from adequate data protection safeguards. Therefore, the adequacy decisions adopted for these 11 countries and territories remain in place and data can continue to flow freely to these jurisdictions. The review has demonstrated that the data protection frameworks in these countries and territories have further converged with the EU’s framework and strengthened protection of personal data in their jurisdictions. The GDPR has inspired positive changes such as the introduction of new rights for individuals, the reinforcement of the independence and powers of authorities responsible for the enforcement of privacy laws or the modernisation of rules on international transfers.

The country reports show that since the adoption of the adequacy decisions under the 1995 Data Protection Directive, the different countries and territories have carried out a comprehensive modernisation of their privacy legislation. They have further aligned their frameworks with the GDPR or introduced specific reforms, which significantly strengthened safeguards for personal data. These reforms reinforced, for example, the independence and enforcement powers of data protection authorities. To bridge certain gaps with the EU privacy framework, some countries put in place specific safeguards to strengthen the protection of data coming from the European Economic Area, including to facilitate the exercise by Europeans of their rights. The review also showed that public authorities in the 11 jurisdictions are subject to appropriate safeguards in the area of access to data by public authorities, notably for law enforcement or national security purposes. This includes effective oversight and redress mechanisms.

The Commission will continue to monitor relevant developments in the countries and territories concerned, in particular, where further legislative reforms are ongoing. The GDPR requires the Commission to periodically review adequacy decisions.   

Background

With the entry into application of the GDPR in May 2018, the adequacy decisions adopted under the Data Protection Directive remained in force. At the same time, the GDPR clarifies that adequacy decisions are “living instruments” and requires the Commission to periodically review these decisions.

When carrying out its first review, the Commission evaluated the developments in the countries and territories’ data protection frameworks since the adoption of the adequacy decisions, and also assessed the rules in place on government access to data for law enforcement and national security purposes.

In the event of developments in an adequate country or territory that would negatively affect the level of protection for personal data, the Commission has the power to suspend, amend or withdraw an adequacy decision.

In total there are 16 adequacy decisions in place, respectively for Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom (under the GDPR and the LED) , the United States (for commercial organisations certified under the EU-US Data Privacy Framework) and Uruguay.

In 2019, the EU and Japan recognised each other’s data protection systems as ‘equivalent’, thereby allowing personal data to flow freely between them. This arrangement created the world’s largest area of free and safe data flows. In June 2023, the EU adopted adequacy decisions for the United Kingdom and in January 2022 for South Korea. In July 2023, the Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework.

A first review of the arrangement with Japan was concluded with the adoption of a report in April 2023 and the Commission also monitors the enforcement of the arrangements that are in place with the United Kingdom and the United States.

For more information

Data protection adequacy for non-EU countries (europa.eu)

Data protection in the EU (europa.eu)

Report on adequacy decisions adopted under the Data Protection Directive

Quote(s)

The adequacy decisions have laid the foundation for cooperation and convergence between the EU and like-minded partners. Together we focus on a human-centric and democratic development of the digital economy, where personal data can flow freely and safely.

Věra Jourová, Vice-President for Values and Transparency

In today’s world, cross-border data flows are an integral part of our economy and daily lives. I very much welcome that all 11 countries and territories concerned by this review have brought their data protection regimes even closer to ours. Our adequacy decisions form the world’s broadest network of safe and free data flows. We will step up our engagement with international partners to develop this network even further.

Didier Reynders, Commissioner for Justice