Data Protection:Written question - HL17041

Asked by Lord Freyberg
Asked on: 09 July 2019
Department for Digital, Culture, Media and Sport
Data Protection
To ask Her Majesty's Government which (1) businesses, (2) territories of, or (3) specified sectors within, third countries have been recognised by the EU as providing adequate data protection.
Answered by: Lord Ashton of Hyde
Answered on: 19 July 2019

The European Commission has so far made a full finding of adequacy in respect of: Andorra, Argentina, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay. The Commission has made partial findings of adequacy in respect of Japan, Canada and the USA. You can find more information about these decisions on the Information Commissioner’s website.

When the UK leaves the EU the power to make adequacy decisions will be repatriated to the Secretary of State. In February 2019 Parliament passed a Statutory Instrument (SI) setting out the criteria and process. The SI recognises and effectively rolls over all existing adequacy decisions that have been made by the EU as well as recognising EU states themselves as adequate. The SI also replicates the EU adequacy regime in UK law with a number of technical changes to make it work properly. The factors that the Secretary of State would need to take into account in reaching an adequacy decision include the rule of law, respect for human rights, and other relevant legislation in the third country being assessed.

Grouped Questions: HL17040 | HL17042

Share this page