Review of international data flows: EU reports on adequacy decisions

The European Commission recently conducted a comprehensive review of the adequacy decisions granted to 11 countries or territories prior to the implementation of the General Data Protection Regulation (GDPR). This post provides an analysis and commentary on the findings of the review.

The digitisation of society and globalisation have led to an exponential increase in international data flows. To ensure the protection of individuals' rights in personal data, the EU's GDPR requires that transfers to third countries guarantee an equivalent level of protection. Adequacy decisions, granted by the European Commission, enable the free flow of personal data from the EU to countries that meet the required level of protection.

• Scope of the review: The review focused on developments in both the EU data protection regime and the data protection frameworks of the relevant countries and territories since the adoption of the adequacy decisions. The Commission assessed legislative and regulatory reforms, enforcement practices, case law, and changes in the data protection landscape of each country.
• Findings: The review found that each of the 11 countries or territories remained compliant and provided an adequate level of protection in line with the EU's evolving data protection framework. In most cases, there was further convergence with the EU's framework regarding government access to personal data and related oversight and redress mechanisms. Several countries, such as Israel and Uruguay, adopted new privacy rules, while others clarified existing privacy rules based on enforcement practice or case law.
• Future monitoring: While the review had positive outcomes, the Commission emphasised that adequacy decisions are not an endpoint, but a mechanism for ongoing dialogue and cooperation on data flows and digital matters. The Commission will continue to monitor developments in the protection frameworks and actual practice of the in-scope jurisdictions.

The review reaffirms that the free flow of personal data from the EU to the 11 countries or territories with adequacy decisions remains adequately protected. However, it is important to note that adequacy decisions require regular review, and organizations should stay informed about any updates or changes in the data protection landscape.