Data protection adequacy for non-EU countries (original) (raw)

The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection.

The adoption of an adequacy decision involves:

At any time, the European Parliament and the Council may request the European Commission to maintain, amend or withdraw the adequacy decision on the grounds that its act exceeds the implementing powers provided for in the regulation.

The effect of such a decision is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary. In others words, transfers to the country in question will be assimilated to intra-EU transmissions of data.

The European Commission has so far recognised:

With the exception of the United Kingdom, these adequacy decisions do not cover data exchanges in the law enforcement sector which are governed by the Law Enforcement Directive (Article 36 of Directive (EU) 2016/680).

The Commission is required to periodically review the adequacy decisions adopted under the GDPR and its predecessor, Directive 95/46/EC, and to report its findings to the European Parliament and the Council. In line with this obligation, the Commission published its Report on the first periodic review of the adequacy decision for Japan on 4 April 2023. On 15 January 2024 the Commission published its Report on the first review of the functioning of the eleven adequacy decisions adopted pursuant to Directive 95/46/EC, as well as the accompanying country reports. On 9 October 2024, the Commission published its Report on the first review of the functioning of the adequacy decision on the EU-US Data Privacy Framework.

High-level meeting on International Data Flows

On 4 March 2024, the Commission hosted the first ever high-level meeting on safe data flows, gathering responsible Ministers and heads of the data protection authorities of 15 countries and territories for which the EU has adopted an adequacy decision as well as the Chair of the European Data Protection Board. Participants discussed ways to leverage this network of like-minded partners to maximise the benefits of safe and free data flows and explored avenues for closer cooperation on enforcement of data protection rules.

Adequacy decisions latest

Joint press statement by Commissioner Michael McGrath and TEZUKA Satoru, Chairperson of the Personal Information Protection Commission of Japan

Joint Press Statement: Korea DPA

Today, the European Commission and Brazil adopted mutual adequacy decisions, confirming that their levels of data protection are comparable.

Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, Michael McGrath, and President Waldemar Gonçalves Ortunho Júnior of the Agência Nacional de Proteção de Dados, welcomed the adoption of their respective mutual adequacy decisions.

Documents

Adequacy Decision for Brazil

Renewal of EU adequacy decision for the UK under the GDPR

Renewal of EU adequacy decision for the UK under the LED

Adequacy decision for the European Patent Organisation

Technical extension of the UK Adequacy Decision under the GDPR

Technical extension of the UK Adequacy Decision under the LED

Report on the first periodic review of the functioning of the adequacy decision on the EU-US Data Privacy Framework

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Commission Staff Working Document - Country reports on the functioning of the adequacy decisions adopted under Directive 95/46/EC

Adequacy decision for the EU-US Data Privacy Framework

Report on the first periodic review of the adequacy decision for Japan

Commission Staff Working Document - Report on the first periodic review of the adequacy decision for Japan

Decision on the adequate protection of personal data by the Republic of Korea with annexes

Decision on the adequate protection of personal data by the United Kingdom - General Data Protection Regulation

Decision on the adequate protection of personal data by the United Kingdom: Law Enforcement Directive

EU Japan Adequacy Decision - Factsheet

Press release - 19 February 2021

Press release - 5 September 2018

Press Statement - 20 November 2017

Joint Declaration - 6 July 2017

Joint Statement - 4 July 2017