Support Centre

EU: EDPB issues recommendations on adequacy under the Law Enforcement Directive

The European Data Protection Board ('EDPB') published, on 2 February 2021, its recommendations on the adequacy referential under the EU Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680) ('Law Enforcement Directive') that were adopted at its 45th plenary session. In particular, the recommendations address, among others, procedural issues surrounding adequacy findings under the Law Enforcement Directive, EU standards for adequacy in police and judicial cooperation in criminal matters, such as the purpose limitation and data retention principles, as well as additional principles for specific types of processing related to automated decision-making and profiling and Data Protection by Design and Default.

More specifically, in relation to EU standards for adequacy, the recommendations note that Article 35(2) of the Law Enforcement Directive provides the elements to be considered by the European Commission when assessing the adequacy of a third country alongside highlighting that any meaningful analysis of adequate protection must comprise two elements, namely the content of the rules applicable and the means for ensuring their effective implementation in practice.

In addition, in relation to automated decision-making, the EDPB highlighted that the third country should, in any case, provide for necessary safeguards for the data subject's rights and freedoms and that the existence of a mechanism to inform the relevant Member State's competent authorities of any further processing, such as the use of the transferred data for large-scale profiling, should be considered.

You can read the recommendations here.