European Commission maintains adequacy decisions for data flows to 11 countries and territories

The European Commission has completed a review of 11 adequacy decisions related to data protection, finding that personal data transferred from the EU to Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay continues to be adequately protected. In its report, the European Commission finds that the existing adequacy decisions for these jurisdictions remain valid, allowing uninterrupted data flow. The review highlights the alignment of data protection frameworks in these countries with the EU’s, showcasing strengthened personal data protection. Positive outcomes include introducing new individual rights, enhanced authority powers, and modernized rules on international data transfers inspired by the General Data Protection Regulation (GDPR).

Why does it matter?

The country reports reveal that, since the adoption of adequacy decisions under the 1995 Data Protection Directive, these countries and territories have strengthened their privacy legislation, aligning with the GDPR and implementing reforms. These efforts have significantly strengthened personal data safeguards, emphasizing data protection authorities’ independence and enforcement powers. Certain jurisdictions have instituted specific safeguards to address disparities with the EU framework, enhancing data protection for information originating from the European Economic Area (EEA). The review confirms that public authorities in these regions adhere to appropriate safeguards regarding data access, especially for law enforcement and national security, incorporating effective oversight and redress mechanisms. Ongoing legislative reforms will be continually monitored as mandated by the GDPR.