This week the European Commission published its review of 11 data protection adequacy decisions, finding that all of the jurisdictions, including the Isle of Man, Jersey and Guernsey, continue to treat personal data with adequate safeguards.
Adequacy status allows personal data to flow to the Islands from the EU without the need for businesses to negotiate and implement additional safeguards, such as contractual clauses; greatly simplifying international business.
This is also good news for Island businesses transferring personal data to other “adequate” jurisdictions (such as between the Crown Dependencies), providing assurance that transfers can continue to take place without additional measures.
The adequacy decisions under review were initially made on the basis of data protection legislation preceding the GDPR, and this is the first formal confirmation that the jurisdictions have successfully kept pace with the enhanced standards adopted in the European Union.
Adequacy decisions are “living instruments”, so the Commission will monitor developments in the jurisdictions on an ongoing basis and periodically review its decisions at least every four years. This first review was delayed in order to take into account developing case law on international standards.
