The European Commission published a report reviewing 11 of 16 existing data protection adequacy agreements to facilitate data transfers, finding each adequacy partner "continues to benefit from adequate data protection safeguards." The reviews confirmed data protection standards in Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and reviews focused on "developments in the countries and territories' data protection frameworks since the adoption of the adequacy decisions, and also assessed the rules in place on government access to data for law enforcement and national security purposes."
European Commissioner for Justice Didier Reynders forecasted the report during his
"Our adequacy decisions form the world’s broadest network of safe and free data flows. We will step up our engagement with international partners to develop this network even further," he added.
Hogan Lovells Partner Eduardo Ustaran, CIPP/E, said the report reflects how data protection is "always work in practice," for countries and organizations, and the Commission's understanding that "data protection regimes are evolving should be seen as an opportunity to improve things."
While the Commission's report acknowledged countries "have further converged with the EU's framework and strengthened protection of personal data in their jurisdictions," there was also recognition of ongoing legislative reform for some adequacy partners. The review generated recommendations for "enshrining in legislation the protections that have been developed at sub-legislative level and by case law," particularly in the cases of Argentina, Canada and Israel.
Argentina Agency of Access to Public Information Director Beatriz Anchorena issued a statement on the EU-Argentina adequacy review, noting how it "ratifies the work that we have been doing at the AAIP to harmonize our regulatory framework with the highest international standards." She added the reaffirmation of adequacy "is an important step" as it relates to updates on to the Personal Data Protection Law Convention 108+ was important given that it provides "the only legally binding multilateral instrument that aims to protect the privacy of individuals against possible abuses in the processing of their data."
Israel's adequacy with the EU follows a similar methodology, according to Or-Hof Law owner Dan Or-Hof, CIPP/E, CIPP/US, CIPM, FIP. He said the Commission's determination "is based on guidelines published by the Privacy Protection Authority and on caselaw."
The PPA produced a wealth of pertinent Privacy Protection Law guidance in 2023, including explicit biometric and right of access.
Or-Hof added that rescinding adequacy or threatening as much while legislative reform is ongoing may present as "pressure" to fast-track legislation.
"Israel has put tremendous efforts to satisfy the EU, with new regulations, government decisions and years of discussions," He said. "However, there are still considerable gaps between the GDPR and the PPL, and at the same time Israeli laws include provisions that do not exist under the GDPR, especially concerning cybersecurity."
The circumstances around Argentina and Israel's adequacy further prove the EU's standards for equivalence do not correlate with a framework identical to the GDPR.
"A crucial aspect to appreciate is that the principle that a legal framework does not need to be a carbon copy to create appropriate protections is still valid as far as the Commission is concerned," Hogan Lovells' Ustaran said. "This is key because it is aligned with the idea that it should be possible to have interoperable systems, even if they emanate from different legal traditions and frameworks."
Reviews for decisions with the Japan, South Korea, the U.K. — one for commercial entities under the GDPR and another under the EU Law Enforcement Directive — and the U.S. were not included in the report. Notably, the U.K. decision is likely to be revisited once the U.K. General Data Protection Regulation is reformed or replaced while the U.S. decision under the
