Three European Free Trade Association (EFTA) countries, (Iceland, Liechtenstein, and Norway) have implemented the EU data protection rules in a comprehensive manner. This implementation is covered by Annex XI of the EEA Agreement on Electronic Communication, Audiovisual Services, and Information Society.
This implementation is covered by Annex XI of the EEA Agreement on Electronic Communication, Audiovisual Services, and Information Society. All relevant EU data protection instruments, including the General Data Protection Regulation (GDPR) (EU) 2016/679 and all related “adequacy decisions” allowing international transfers of personal data with counterparties located outside the EEA are included in this agreement. As a result, individuals in the EEA EFTA States and in the Union benefit from the same level of protection.
The EFTA Surveillance Authority (ESA) has also adopted its own rules for the protection of individuals with regard to the processing of personal data. To ensure compliance with these rules, ESA has an agreement with the European Data Protection Supervisor (EDPS). The EDPS ensures that ESA’s processing of personal data complies with College Decision No 100/19/COL. Thus, the EDPS plays a crucial role in supporting data protection by the EFTA Surveillance Authority.