Home » Data transfers to third countries » Commission’s Decisions on the adequate level of personal data protection

Commission’s Decisions on the adequate level of personal data protection

The European Commission has the power to determine, on the basis of Article 45 of Regulation (EU) 2016/679 (GDPR) whether a country outside the EEA offers an adequate level of data protection.

The procedure for the adoption of an adequacy decision at the EU level involves:

- a proposal from the European Commission;

- an opinion of the European Data Protection Board;

- an approval from representatives of EU countries;

- the adoption of the decision by the European Commission.

At any time, the European Parliament and the Council of the EU may request the European Commission to maintain, amend or withdraw the adequacy decision on the grounds that its act exceeds the implementing powers provided for in the regulation.

The effect of such a decision is that personal data can flow from the EEA to that third country without any further safeguard being necessary. In other words, transfers to the country in question will be assimilated to intra-EEA transmissions of data.

A determination of adequacy of the data protection level may cover the entire territory of the third country, particular controllers and their ambit (in accordance with a specific legal framework, including a national law on data protection), or particular programmes for data exchanges or types of processing.

The European Commission has so far recognised the following 13 countries (listed alphabetically) as providing adequate protection: the Principality of Andorra, the Argentine Republic, Canada, the Faroe Islands, the Bailiwick of Guernsey, the State of Israel, the Isle of Man, Japan, the Bailiwick of Jersey, New Zealand, the Swiss Confederation, the Oriental Republic of Uruguay, the United Kingdom.

These adequacy decisions do not cover data exchanges in the law enforcement sector which are governed by Article 36 of Directive (EU) 2016/680.

In respect of the US, in 2016 the European Commission adopted an adequacy decision on the EU-US Privacy Shield, which was invalidated by a judgment of the Court of Justice of the EU of 16 July 2020. Therefore, data from an EEA country to the US should be transferred through an alternative tool for data transfers to third countries, chosen by the controller/processor, in accordance with the options laid down in Chapter V of the GDPR.

Adequacy talks with South Korea were concluded on 30 March 2021, and on 19 February 2021, the Commission launched the procedure for the adoption of two adequacy decisions for transfers of personal data to the United Kingdom, under the GDPR and Directive (EU) 2016/680 (the Law Enforcement Directive), respectively.

Decisions on an adequate level of personal data protection adopted by the European Commission by 20 April 2021:

1. Commission Decision of 19 October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra

2. Commission Decision of 30 June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina

3. Commission Decision of 21 November 2003 on the adequate protection of personal data in Guernsey

4. Commission Decision of 8 May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey

5. Commission Decision of 31 January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data

6. Commission Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act

7. Commission Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man

8. Commission Implementing Decision of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand

9. Commission Implementing Decision of 21 August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

10. Commission Decision of 5 March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data

11. Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland