In a landmark move for international data transfers, the European Data Protection Board (EDPB) has endorsed the European Commission’s draft adequacy decision recognising the European Patent Organisation (EPO) as offering an adequate level of personal data protection. This is the first time such a decision concerns an international organisation rather than a country or territory.
Under Article 45 GDPR, an adequacy decision allows the free flow of personal data from the EU to a third country or international body without requiring further safeguards. Until now, all adequacy decisions have applied exclusively to states or regions.
The EDPB stated that the EPO’s legal framework is largely aligned with the GDPR, particularly in terms of data protection principles, individual rights, and oversight mechanisms. EDPB emphasised that this decision illustrates how international organisations can meet EU standards for data protection, enabling secure data flows while respecting their specific legal status.
The EDPB also underlined the importance of continued engagement between the Commission and international organisations to expand the use of such adequacy decisions in the future.
While broadly supportive, the EDPB recommended that the Commission provide further clarification on areas such as the independence of oversight bodies, the role of the EPO’s Data Protection Officer, and the safeguards surrounding onward transfers, especially in the context of law enforcement access.
The Commission is now expected to formally adopt the decision, setting a precedent for how international organisations can be recognised as ensuring an adequate level of protection under EU data protection law.
Click here to read the full opinion from the EDPB.
