Cybersecurity Policy Report, EDPB Supports European Commission Adequacy Decisions, (Dec 9, 2024)

By Tony Foley

The European Data Protection Board (EDPB) sent a letter to the European Commission last week outlining the results of its review of the EC’s 11 adequacy decisions adopted under Directive 95/46/EC, the predecessor to the European Union’s General Data Protection Regulation (GDPR).

Under article 45(9) of the GDPR, adequacy decisions adopted by the EC on the basis of Directive 95/46/EC are to remain in place until they are amended, replaced, or repealed by the EC. The EC completed its review of its adequacy decisions for the 11 jurisdictions in January, finding that the countries reviewed had modernized their privacy legislation to align with the GDPR and strengthened safeguards for personal data (CPR, Jan. 16).

The EDPB letter acknowledged the work of the EC in reviewing and accepting the existing adequacy decisions and did not question the substance of the EC report. Based on its previous reviews of adequacy decisions and its experience in the field, however, the EDPB offered a variety of observations on the methodology of the EC’s adequacy assessment. Specifically, the EDPB suggested that, in future adequacy reviews, the EC describe in more detail information concerning the following issues:

1. The legal notions of “controller,” “processor,” and “recipient,” or equivalent notions, which do not have to mirror GDPR terminology but should be consistent with the terms as defined in the GDPR;

2. The legal bases under which personal data may be lawfully, fairly, and legitimately processed;

3. The fact that individuals in the EU can exercise their rights in third countries and territories;

4. The inclusion of general descriptions and reassurances on limitations applicable to data subjects’ rights, both within and without the context of access to the data by third country authorities;

5. Safeguards related to automated decision making, including the rights to be informed of a decision and the logic behind the decision, to correct inaccurate information, and to contest a decision when made on the basis of inaccurate information;

6. The international commitments that the third country has entered into or other obligations arising from the third country’s participation in regional or multilateral systems; and

7. The rules of onward transfers in the assessed third country and how their application in practice has developed since the adoption of the adequacy decisions.

The letter also offers observations related to access to and use of personal data transferred from the EU to public authorities in the third countries. The EDPB suggests that the EC closely monitor the national provisions allowing law enforcement authorities and intelligence agencies to obtain personal data transferred under the adequacy decisions through voluntary disclosures and their application in practice as well as developments in the relevant legal framework.

News: InternationalLegislation DataPrivacy GDPR