Navigation path

Commission decisions on the adequacy of the protection of personal data in third countries

The Council and the European Parliament have given the Commission the power to determine, on the basis of Article 25(6) of Directive 95/46/EC  whether a third country ensures an adequate level of protection by reason of its domestic law or of the international commitments it has entered into. The adoption of a (comitology) Commission decision based on Article 25.6 of the Directive involves:

  • a proposal from the Commission;
  • an opinion by Member States' data protection authorities and the EDPS  (European Data Protection Supervisor), in the framework of the Article 29 Working Party ;
  • an approval from the "Article 31 Committee", composed of representatives of Member States, under the comitology  "examination procedure";
  • the adoption of the decision by the College of Commissioners;
  • at any time, the European Parliament and the Council may request the Commission to maintain, amend or withdraw the adequacy decision on the grounds that its act exceeds the implementing powers provided for in the Directive.

The effect of such a decision is that personal data can flow from the 28 EU countries and three EEA member countries (Norway, Liechtenstein and Iceland) to that third country without any further safeguard being necessary.

The Commission has so far recognized Andorra, Argentina, Canada (commercial organisations), Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay as providing adequate protection.

These adequacy decisions do not cover data exchanges in the law enforcement sector. For special arrangements concerning exchanges of data in this field, see the PNR (Passenger Name Record) and TFTP (Terrorist Financing Tracking Programme) agreements.

AD - Andorra

  • 2010/625/EU: Commission Decision of 19 October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra (notified under document C(2010) 7084) Text with EEA relevance.
  • Opinion 7/2009pdf(63 kB) Choose translations of the previous link  of the Article 29 Working Party on the level of protection of personal data in the Principality of Andorra.

AR - Argentina

  • 2003/490/EC: Commission Decision of 30 June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina
  • Opinion 4/2002pdf(60 kB) Choose translations of the previous link  of the Article 29 Working Party on the level of protection of personal data in Argentina

CA - Canada

  • SEC(2006) 1520pdf(66 kB) Choose translations of the previous link : Commission Staff Working Document: The application of Commission Decision 2002/2/EC of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documentation Act
  • Frequently asked questions on the Commission's adequacy finding on the Canadian Personal Information Protection and Electronic Documents Act (March 2002)
  • 2002/2/EC: Commission Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act (notified under document number C(2001) 4539)
  • Opinion 2/2001pdf(42 kB) Choose translations of the previous link  of the Article 29 Data Protection Working Party on the adequacy of the Canadian Personal Information and Electronic Documents Act

CH - Switzerland

  • SEC (2004) 1322pdf(31 kB) Choose translations of the previous link : Commission Staff Working Document: The application of Commission Decision 2000/518/EC of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland
  • 2000/518/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland (notified under document number C(2000) 2304)
  • Opinion 5/99pdf(167 kB) Choose translations of the previous link  of the Article 29 Data Protection Working Party on the level of protection of personal data in Switzerland

FO - Faeroe Islands

  • 2010/146/EU: Commission Decision of 5 March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data (notified under document C(2010) 1130)
  • Opinion 9/2007pdf(73 kB) Choose translations of the previous link  of the Article 29 Data Protection Working Party on the level of data protection in the Faeroe Islands

GG - Guernsey

  • 2003/821/EC: Commission Decision of 21 November 2003 on the adequate protection of personal data in Guernsey (Text with EEA relevance) (notified under document number C(2003) 4309)
  • Opinion 5/2003pdf(85 kB) Choose translations of the previous link  of the Article 29 Working Party  on the level of data protection in Guernsey

IL - State of Israel

  • 2011/61/EU: Commission Decision of 31 January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data (notified under document C(2011) 332)
  • Opinion 6/2009pdf(89 kB) Choose translations of the previous link  of the Article 29 Working Party on the level of protection of personal data in the State of Israel

IM - Isle of Man

  • 2004/411/EC: Commission Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man
  • Opinion 6/2003pdf(111 kB) Choose translations of the previous link  of the Article 29 Working Party on the level of protection of personal data in the Isle of Man

JE - Jersey

  • 2008/393/EC: Commission Decision of 8 May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey (notified under document number C(2008) 1746)
  • Opinion 8/2007pdf(72 kB) Choose translations of the previous link  of the Article 29 Working Party on the level of protection of personal data in Jersey

NZ - New Zealand

  • 2013/65/EU: Commission Implementing Decision of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand (notified under document C(2012) 9557)
  • Opinion 11/2011pdf Choose translations of the previous link  of the Article 29 Working Party on the level of protection of personal data in New Zealand

US - United States - EU-US Privacy Shield

Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document number C(2016) 4176) decision on the adequacy of protection of the EU-US Privacy Shield.

Background:

On 6 October 2015, the Court of Justice of the European Union declared the Commission’s 2000 Decision on EU-US Safe Harbour invalid.

On 6 November 2015 the European Commission adopted a Communication on the Transfer of Personal Data from the EU to the United States of America under Directive 95/46/EC following the Judgment by the Court of Justice in Case C-362/14 (Schrems). The aim was to provide an overview of the alternative tools for transatlantic data transfers in the absence of an adequacy decision.

On 29 February 2016, the Commission published a draft adequacy decision and the relevant commitments by U.S. authorities.

On 13 April 2016, the Article 29 Working Party issued its opinion: Opinion 01/2016 of the Article 29 Working Party on the EU – U.S. Privacy Shield draft adequacy decisionpdf(613 kB) Choose translations of the previous link .

On 8 July 2016, the Article 31 (comitology) Committee approved the revised draft decision.

On 12 July 2016, the Commission adopted Decision 2016/1250 on the adequacy of protection of the EU-U.S. Privacy Shield.

Other documents:

  • COM(2016) 117pdf(442 kB) Choose translations of the previous link  - Communication on Transatlantic Data Flows: Restoring Trust through Strong Safeguards
  • COM(2015)566pdf(379 kB) -  Communication on the Transfer of Personal Data from the EU to the United States of America under Directive 95/46/EC following the Judgement by the Court of Justice in Case C-362/14 (Schrems) - 6 November 2015
  • Case C-362/14 - Schrems v Data Protection Commissioner
  • Guide to the EU-U.S. Privacy Shieldpdf(305 kB) Choose translations of the previous link   (click on the previous icon to select more languages of the guide)

UY - Eastern Republic of Uruguay

  • 2012/484/EU: Commission Implementing Decision of 21 August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data (notified under document C(2012) 5704)
  • Opinion 6/2010pdf Choose translations of the previous link  of the Article 29 Working Party on the level of protection of personal data in the Eastern Republic of Uruguay