Privacy & Information Security Law Blog

On January 15, 2024, the European Commission released its “report on the first review of the functioning of the Adequacy Decisions adopted pursuant to Article 25(6) of Directive 95/46/EC” (the “Report”). The Report details the results of the European Commission’s assessment of whether 11 jurisdictions (Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay) that benefit from Adequacy Decisions adopted under the repealed Directive 95/46/EC still offer sufficient guarantees to maintain adequacy status under the EU General Data Protection Regulation (“GDPR”).

While Adequacy Decisions adopted under Directive 95/46/EC remain valid under the GDPR, the European Commission is required to, on an ongoing basis, monitor developments in third countries and international organizations that could affect their functioning. Additionally, at least every four years, existing Adequacy Decisions are subject to a review process.

In the current review, the European Commission concluded that the Adequacy Decisions should be maintained for all 11 jurisdictions. According to the Report “the data protection frameworks in place in each of the eleven countries or territories have further converged with the framework of the EU. Moreover, in the area of government access to personal data, the first review has shown that the law of these countries or territories imposes appropriate safeguards and limitations and provides oversight and redress mechanisms in this area.”

Read the Report.