EU personal data flows can continue in Uruguay

By Pittaluga Abogados

The European Commission successfully concluded its review of 11 existing adequacy decisions. These decisions had been adopted under the EU data protection legislation that preceded the General Data Protection Regulation (GDPR).

In its report, the Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay, continues to benefit from adequate data protection safeguards. Therefore, the adequacy decisions adopted for these 11 countries and territories remain in place and data can continue to flow freely to these jurisdictions.

The review has demonstrated that the data protection frameworks in these countries and territories have further converged with the EU's framework and strengthened protection of personal data in their jurisdictions. The GDPR has inspired positive changes such as the introduction of new rights for individuals, the reinforcement of the independence and powers of authorities responsible for the enforcement of privacy laws or the modernisation of rules on international transfers.

The country reports show that since the adoption of the adequacy decisions under the 1995 Data Protection Directive, the different countries and territories have carried out a comprehensive modernisation of their privacy legislation. They have further aligned their frameworks with the GDPR or introduced specific reforms, which significantly strengthened safeguards for personal data. These reforms reinforced, for example, the independence and enforcement powers of data protection authorities. To bridge certain gaps with the EU privacy framework, some countries put in place specific safeguards to strengthen the protection of data coming from the European Economic Area, including to facilitate the exercise by Europeans of their rights. The review also showed that public authorities in the 11 jurisdictions are subject to appropriate safeguards in the area of access to data by public authorities, notably for law enforcement or national security purposes. This includes effective oversight and redress mechanisms.

The Commission will continue to monitor relevant developments in the countries and territories concerned, in particular, where further legislative reforms are ongoing. The GDPR requires the Commission to periodically review adequacy decisions.