The European Commission concluded its long awaited review of existing GDPR adequacy status on 15 January 2024. New Zealand and European businesses doing business with kiwis can finally relax (at least until 2028), as the European Commission confirmed that New Zealand continues to benefit from adequate data protection safeguards and personal data can continue to flow freely from the EU to New Zealand.

New Zealand has been benefitting from adequacy status since 2012, reducing the compliance burden on NZ organisations processing personal data on behalf of EU-based customers, including NZ SaaS companies and other entities doing business in or with the EU.

Background – what is an adequacy decision?

As we reported last year, the concept of an ‘adequacy decision’ is found in article 45 of the General Data Protection Regulation (‘GDPR’). It provides that the transfer of personal data from an EU country to a third country outside the EU is permitted where the European Commission has determined that the third country (or a specified sector within that third country) maintains an adequate level of protection. This reduces compliance requirements for organisations because it means that the transfer of personal data to a third country outside the EU with an adequacy status does not require any additional authorisation.

The adequacy test relies upon the ‘essentially equivalent’ standard. Rather than requiring a third country to ensure a level of protection that is identical to the one guaranteed in the EU, third countries must only have a level of protection that is essentially equivalent to that offered in the EU. The adequacy mechanisms were tested before the European Court of Justice in the famous Schrems I and Schrems II decisions we previously reported about. The Court clarified that relevant legal frameworks should bind public authorities in third countries to minimum safeguards ensuring they cannot simply access data beyond what is necessary and proportionate to pursue legitimate objectives, while allowing data subjects to enjoy effective and enforceable rights against such authorities.

Importantly, an adequacy decision does not mark the end of the road. Article 97 of the GDPR requires the European Commission to periodically review its adequacy decisions every four years to determine whether the countries and territories with adequacy status continue to provide an adequate level of protection for personal data. The European Commission provides in its report that “an adequacy decision is not an ‘end point’ but provides an opportunity to further intensify the dialogue and cooperation with like-minded international partners on data flows and digital matters more generally”.

So… what does the European Commission have to say about New Zealand’s standards?

The European Commission is pleased with New Zealand’s data protection framework. In particular, the Commission “welcomes” the newer developments in our regime, namely, the adoption of the Privacy Act 2020 which “further increased the convergence with the EU’s data protection framework, notably as regards the rules for international transfers of personal data and the powers of data protection authority (the Office of the Privacy Commissioner).”

The Commission highlights that “public authorities in New Zealand are subject to clear, precise and accessible rules under which such authorities can access and subsequently use for public interest objectives, in particular for criminal law enforcement and national security purposes, data transferred from the EU.” It also noted that there are different oversight and redress mechanisms in this space.

The Commission also “welcomes” the introduction of the Privacy Amendment Bill, on which we reported last year. Which means we can safely expect the Bill to be progressed in the Parliament by the new government, supported by the backing of the Commission.

Maintaining adequacy is a big deal – here’s why you should care

New Zealand’s GDPR adequacy status is often undervalued although it provides a tangible benefit for New Zealand businesses (especially in the software industry) who offer services to the EU. They will not need to find their way out of the GDPR compliance maze, which can be an arduous and expensive process.

The European Commission beautifully captures the benefits of having GDPR adequacy. The Commission notes that adequacy decisions enable the free flow of personal data and open up commercial channels for EU operators and eases cooperation with foreign partners in a broad range of regulatory fields, including by non-EU jurisdictions who are comforted by the recognition of ‘gold-standard’ protection under GDPR adequacy.

However, this is not the end of the story…

The European Commission is determined to ensure third countries are aware that this review is not an ‘end point’. Instead, it is intended to lay the foundation for closer cooperation and further regulatory convergency between the EU and third countries. As part of this, the European Commissioner intends to organise a ‘high-level meeting’ in 2024 which will bring together representatives from the EU as well as all countries which benefit from an adequacy decision.

Get in touch

If you’d like to know about whether GDPR applies to you or how New Zealand’s adequacy decision might affect you—particularly if you provide services to EU-based customers—then get in touch with our privacy and data protection experts Hayley Miller, Campbell Featherstone, Gunes Haksever or Ashleigh Ooi.

This article was written by Gunes Haksever, a senior associate, and Lavi Abitbol, a solicitor, in our commercial, technology and privacy team.