Comparing LED and GDPR Adequacy: One Standard Two Systems

Abstract

The 2015 Schrems decision established that for an adequacy decision authorizing personal data transfers from the European Union (EU) to a third country, that third country has to have a level of protection of fundamental rights and freedoms ‘essentially equivalent’ to that in the EU. Since May 2018, the European Commission (Commission) has the exclusive competence not only to assess third countries for an adequacy decision in relation to the General Data Protection Regulation (GDPR) but also in relation to the Law Enforcement Directive (LED). However, so far, no LED adequacy decision has been adopted. The absence of any LED adequacy decisions and the presence of GDPR adequacy decisions (the latest concerning Japan) invites a comparative analysis of adequacy decisions under both EU instruments, also to assess whether GDPR adequacy decisions could serve as orientation for the adequacy assessment under the LED as suggested by the Commission. Having conducted this comparison, I argue that actually LED adequacy decision would have to be properly separated from GDPR adequacy decisions, as even though they aim to achieve the same standard of essential equivalence, their system of protection for issues connected to the processing of personal data in a law enforcement context differs. Adequacy decisions, law enforcement, LED, international personal data transfers, fundamental rights, standard of essential equivalence, GDPR