Commentaries: Annex 1

(Art. 8 para. 1)

States, territories, specified sectors in a State and international bodies that guarantee an adequate level of data protection

1	Germany*
2	Andorra***
3	Argentina***
4	Austria*
5	Belgium*
6	Bulgaria***
7	Canada***	An adequate level of data protection is guaranteed if the Canadian Federal Act on Personal Information Protection and Electronic Documents of 13 April 2000¹or the act of a Canadian province that largely corresponds to this Federal Act applies to the private sphere. The Federal Act applies to personal data that is collected, processed or disclosed in the course of commercial activities, irrespective of whether it relates to organisations such as associations, partnerships, individuals or trade unions or undertakings regulated by federal law such as facilities, works, undertakings or business activities that fall within the legislative authority of the Canadian Parliament. The provinces of Quebec, British Columbia and Alberta have issued an act that largely corresponds to the Federal Act; the provinces of Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia have issued an act that largely corresponds to this act in relation to health data. In all Canadian provinces, the Federal Act applies to all personal data that are collected, processed or disclosed by undertakings regulated by federal law, including data on employees of these undertakings. The Federal Act also applies to personal data transferred to another province or another country in the course of commercial activities.
8	Cyprus***
9	Croatia***
10	Denmark*
11	Spain*
12	Estonia*
13	Finland*
14	France*
15	Gibraltar***
16	Greece*
17	Guernsey***
18	Hungary*
19	Isle of Man***
20	Faroe Islands***
21	Ireland***
22	Island*
23	Israel***
24	Italy*
25	Jersey***
26	Latvia*
27	Liechtenstein*
28	Lithuania*
29	Luxembourg*
30	Malta*
31	Monaco***
32	Norway*
33	New Zealand***
34	Netherlands*
35	Poland*
36	Portugal*
37	Czech Republic*
38	Romania***
39	United Kingdom **
40	Slovakia*
41	Slovenia*
42	Sweden*
43	Uruguay***
44	United States***	For personal data processed by organisationscertifiedunder the Principles of the Swiss-US Privacy Framework², an adequate level of protection isdeemed to be guaranteedbased on the safeguards provided by Executive Order 14086 of 7 October 2022³, the Rule on the United States Attorney General's Data Protection Review Court of 7 October 2022⁴and Intelligence Community Directive 126 (Implementation Procedures for the Signals Intelligence Redress Mechanism under Executive Order 14086) issued by the Office of the Director of National Intelligence on 6 December 2022⁵and the Designation of Switzerland on 7 June 2024⁶as a country covered by the two-layer redress mechanism, including access to the Data Protection Review Court.

The assessment of the adequacy of data protection includes the disclosure of personal data in accordance with Directive (EU) 2016/680⁷. ** The assessment of the adequacy of data protection includes the disclosure of personal data in accordance with an implementing decision of the European Commission in which the adequacy of data protection is established in accordance with Directive (EU) 2016/680. *** The assessment of the adequacy of data protection does not include the disclosure of personal data in terms of the cooperation provided for under Directive (EU) 2016/680.

The text of the Canadian Federal Act is available at https://laws-lois.justice.gc.ca/eng/acts/p-8.6/FullText.html. ↩
The principles are available at:www.dataprivacyframework.gov/s/framework-text?tabset-c1491=3. ↩
The Executive Order 14086 is available at:www.state.gov/executive-order-14086-policy-and-procedures/. ↩
The Rule is available at:www.federalregister.gov/documents/2022/10/14/2022-22234/data-protection-review-court. ↩
The Directive is available at:www.dni.gov/files/documents/ICD/ICD_126-Implementation-Procedures-for-SIGINT-Redress-Mechanism.pdf. ↩
The list is available at:www.justice.gov/opcl/media/1355326/dl?inline. ↩
Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, last amended by OJ. L 119 of 4.5.2016, p. 89. ↩

Annex 1

States, territories, specified sectors in a State and international bodies that guarantee an adequate level of data protection

Footnotes