Jusletter IT

In July 2018, the European Parliament questioned the validity of the Privacy Shield, regulating the transfer of personal data to the United States (US). This event shows a persistent lack of clarity regarding the conditions a third country needs to fulfil to be considered adequate from the perspective of the General Data Protection Regulation (GDPR). This paper tries to clarify these conditions by analysing the standard of equivalence that was put forward by the Court of Justice of the European Union (CJEU) in the Schrems case and Opinion 1/15 together with the Charter of Fundamental Rights of the European Union (CFR) and the new provisions on data transfers by the GDPR. Applying the results of this analysis back on the Privacy Shield and the Draft Japan adequacy decision demonstrates that an analysis for adequacy firmly grounded in the CFR is still not being done in practice.