The article discusses the steps leading to the adoption of an adequacy decision by countries that have ratified Convention 108. Despite heading towards the GDPR standards, mere accession to Convention 108 is not enough to suggest that a country's data protection level is adequate. The article points out the difficulty of assessing adequacy, taking into account that it requires not only a common effort from different bodies, but also a deep analysis of the legal data protection framework. In fact, there are a set of data protection principles and enforcement mechanisms, which can be deemed essential when assessing adequacy. Therein lies the difficulty of agreeing on the ‘core’ elements that the European Commission should take into account when adopting this adequacy decision. In the light of the Schrems judgment, the EU adequacy standards for a third country were made significantly more onerous, requiring a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the EU. But what does ‘essentially equivalent’ mean?
Keywords: Adequacy, Convention 108, GDPR, Third Countries, Essentially Equivalent, Core Elements