The phrase "adequacy decision" is correct and usable in written English.
It is typically used in legal and regulatory contexts, particularly in relation to data protection and privacy laws, to refer to a determination that a country or organization provides sufficient protection for personal data.
Example: "The European Commission issued an adequacy decision regarding the transfer of personal data to the United States."
Alternatives: "sufficiency ruling" or "sufficient protection determination".
Denham agreed, underlining how an adequacy decision would be much more limiting.
"And, as indicated in the European Council guidelines, the UK must understand that the only possibility for the EU to protect personal data is through an adequacy decision.
It is already foreseen by the Commission's adequacy decision (Privacy Shield decision) that the data protection authorities will participate in the review".
"An adequacy decision will be made by the Commission, and can be struck down by the European Court of Justice whatever our own position is," Bernal notes.
Once proposed, the decision needs to be confirmed by a panel of representatives from EU Member States, and the Commission can revoke the adequacy decision in the future.
Another possibility is for the UK to receive an adequacy decision from the EC — such as the Commission has granted to other third countries (like the US).
Adequacy decisions may also be invalidated by the CJEU".
"We therefore recommend that the government should seek adequacy decisions to facilitate UK-EU data transfers after the UK has ceased to be a member of the EU.
"Adequacy decisions can only be taken in respect of third countries, and there are therefore legal impediments to having such decisions in place at the moment of exit," the report notes.
"We urge the government to ensure that any transitional arrangements agreed during the withdrawal negotiations provide for continuity of data-sharing, pending the adoption of adequacy decisions in respect of the UK".
To date, the EU has adopted 12 adequacy decisions under its existing data protection directive, including the aforementioned agreement with the US (which covers certified companies), and one with Canada (for transfers to commercial organisations subject to a Canadian data protection act).
