EPO welcomes European Commission’s adequacy decision for safe data flows
The European Patent Organisation (EPOrg) is the first ever International Organisation to receive an adequacy decision by the European Commission. Adequacy decisions are an instrument through which the Commission determines, on the basis of Article 45 of Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR), whether a country outside the EU or an International Organisation offers an adequate level of protection to personal data. Until this moment, the Commission had only issued adequacy decisions towards third countries.
The decision marks a significant step for the safe and free data flow between private and public entities within the European Union (EU) and the EPOrg and is a formal recognition of the highest standards of data protection consistently applied by the EPOrg.
The effect of the EU adequacy decision is that personal data can flow freely from the EU (and Norway, Liechtenstein and Iceland) to the EPOrg without further safeguards in place. This will facilitate all the co-operation activities with national intellectual property offices and all other exchanges with public and private entities subject to the GDPR.
Furthermore, the adequacy decision comes as a confirmation for all stakeholders that the EPOrg maintains the highest standards of data protection, safeguarding individual rights in all daily activities.
EPO President António Campinos said: “The European Commission’s adoption of the first-ever adequacy decision concerning an international organisation marks a historic milestone for both the EPOrg and the international data protection landscape. It reflects the EU’s recognition of the EPOrg’s robust and modern data protection framework and our longstanding commitment to safeguarding the rights of individuals. This decision not only reinforces trust in our operations but also ensures legal certainty for innovators and businesses across the European Union”.
The decision marks the mutual recognition of the respective data protection systems: the European Patent Office had already issued an adequacy decision under its data protection rules (EPO DPR) determining that the data protection legal framework of the European Union offered a level of protection of personal data essentially equivalent to that offered by the EPO DPR. Now the European Commission, after having assessed all aspects of the EPOrg data protection framework, including the safeguards for the rights and freedoms of data subjects, concluded that it provides comparable safeguards to those granted under EU law. To mark this milestone, a joint statement was issued by Michael McGrath, European Commissioner for Democracy, Justice, the Rule of Law, and Consumer Protection, and EPO President António Campinos.
Next steps
The functioning of the adequacy decision will be subject to periodic reviews conducted by the European Commission in collaboration with European data protection authorities and the EPOrg.