In January, the European Commission (EC) released a review of 11 adequacy decisions in accordance with Article 45 of the GDPR. The EC affirmed that each country reviewed had an adequate level of protection, but its justification for the evaluations varied.
In A Diversity of Adequacy: The European Commission’s 11-Country Adequacy Review, Privacy Across Borders Research Assistant, Lauren Macievic, outlines the differences and similarities among the reviews. First, she notes that the countries are diverse in terms of GDP and population. Then, she discusses the EC’s assessment of each country’s data protection framework and how closely it aligns with the GDPR and other international obligations.
Lauren also indicates that every country’s supervisory authority met Article 45’s independence standard, but achieved it through different approaches such as “for-cause removals, prohibitions against Directors holding elected or advocate positions, separate budgets, laws that expressly stipulate the supervisory authority is an independent entity, or the legal personhood of the supervisory authority.” She concludes with addressing how the EC examined the national security frameworks for each country and the common elements she found across each review.
You can read Lauren’s full assessment of the EC’s Adequacy review here.