Adequacy of the European Patent Organisation and extension of the United Kingdom adequacy decisions: the EDPB adopts two opinions

Adequacy of the European Patent Organisation

At the request of the European Commission, the EDPB issued an opinion on the Commission's draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or region.

An adequacy decision is a decision adopted by the European Commission on the basis of Article 45 of the GDPR, which establishes that a third country (i.e. a country not bound by the GDPR) or an international organisation ensures an adequate level of protection for personal data.

The effect of the adequacy decision is to allow the transfer, without additional requirements, of personal data from bodies subject to the GDPR to the third country or international organisation concerned. The list of adequacy decisions adopted by the European Commission is available on its website.

In its opinion, the EDPB notes that the EPO data protection framework is largely aligned with the EU data protection framework, including on data protection rights and general principles.

Six-month extension of the adequacy decisions of the UK

The EDPB also issued an opinion on the European Commission's proposal to extend by 6 months the UK's two adequacy decisions - one adopted under the GDPR and the other under the 2016/680 Law Enforcement Directive - which are set to expire on 27 June 2025.

These decisions had been adopted by the European Commission in June 2021 following the Brexit. Sunset clauses had been introduced in each of the decisions to anticipate a possible radical change in the data protection legal framework after Brexit.

The extension of the adequacy decisions until 27 December 2025 should allow the European Commission to assess the legal framework as it may be amended by a Bill, introduced in the UK Parliament in October 2024 and still under discussion.

In its opinion, the EDPB acknowledges the need for this time-limited extension and underlines its exceptional character due to the ongoing legislative developments in the UK. The EDPB recalls the validity of its remarks in its previous opinions 14/2021 and 15/2021 on the level of data protection in the UK and invites the European Commission to take them into account in its future assessments. It also recalls the obligation of the European Commission to monitor all relevant developments in the UK during the extension period.