# Standards and Regulatory References

## Primary Legislation

### GDPR Article 45 — Transfers on the Basis of an Adequacy Decision
- **Art. 45(1)**: A transfer may take place where the Commission has decided that the third country ensures an adequate level of protection. Such transfers shall not require any specific authorisation.
- **Art. 45(2)**: Assessment criteria: (a) rule of law, human rights, legislation including government access; (b) independent supervisory authority; (c) international commitments.
- **Art. 45(3)**: Commission may adopt implementing acts on adequacy. Periodic review at least every four years. The Commission shall monitor developments that could affect the adequacy finding.
- **Art. 45(4)**: Commission shall monitor developments and may repeal, amend, or suspend the adequacy decision.
- **Art. 45(5)**: Commission may repeal, amend, or suspend by implementing act if the level of protection is no longer adequate.
- **Art. 45(8)**: Commission shall publish a list of all adequacy decisions in the Official Journal and on its website.
- **Art. 45(9)**: Decisions adopted under Directive 95/46/EC remain in force until amended, replaced, or repealed.

## CJEU Case Law

### Schrems I — Case C-362/14 (6 October 2015)
- Invalidated the Safe Harbour adequacy decision (Decision 2000/520/EC).
- Established that the Commission must find that the third country ensures a level of protection "essentially equivalent" to that guaranteed within the EU.
- Confirmed that national SAs retain the power to examine the compatibility of transfers even when an adequacy decision exists.

### Schrems II — Case C-311/18 (16 July 2020)
- Invalidated the Privacy Shield adequacy decision (Decision 2016/1250).
- Applied the "essential equivalence" standard to assess whether US surveillance law (FISA Section 702, EO 12333) met EU fundamental rights standards.
- The DPF adequacy decision was specifically designed to address the Schrems II deficiencies through EO 14086 and the DPRC.

## EDPB Guidance

### EDPB Statement on the UK Adequacy Decision (June 2021)
- Welcomed the UK adequacy decision with sunset clause.
- Noted ongoing monitoring of the UK's data protection framework post-Brexit, particularly any divergence from GDPR standards.

### EDPB Opinion 2/2023 on the EU-US DPF Adequacy Decision (February 2023)
- Acknowledged improvements over Privacy Shield through EO 14086 and DPRC.
- Noted remaining concerns about bulk collection under EO 12333 and the effectiveness of the DPRC.
- Recommended close monitoring and robust annual reviews.

### EDPB Adequacy Referential (WP254, Updated 2018)
- Provides the detailed checklist used by the Commission when assessing a third country's level of protection.
- Covers: content principles (purpose limitation, data quality, proportionality, transparency, security, individual rights); procedural and enforcement mechanisms; and restrictions on onward transfers.

## Individual Adequacy Decisions — Key References

### Japan — Decision (EU) 2019/419
- First adequacy decision based on "convergence" approach (APPI + supplementary rules).
- Supplementary rules bridge gaps between APPI and GDPR on: sensitive data, retention, onward transfers, and anonymisation.

### South Korea — Decision (EU) 2022/254
- Based on the reformed PIPA (2020 amendments).
- Covers both public and private sector.
- Includes commitments from the Korean Personal Information Protection Commission on enforcement cooperation.

### United Kingdom — Decision (EU) 2021/1772
- Adopted 28 June 2021; effective for 4 years (expires 27 June 2025 unless renewed).
- Based on the UK GDPR, DPA 2018, and Investigatory Powers Act 2016.
- Commission must assess any divergence from EU standards before renewal.

### EU-US DPF — Decision (EU) 2023/1795
- Based on DPF self-certification, EO 14086, and DPRC.
- Annual review commitment (first review October 2024).
- Scope limited to FTC/DoT-regulated self-certified organisations.