ADEQUACY DECISIONS UNDER THE GDPR AND ACCESS TO EU DATA: LIMITS FOR THIRD COUNTRIES IN THE AGE OF AI

Аннотация

Cross-border data transfers have become a central element of the global digital economy, particularly in the context of artificial intelligence, which relies on access to large and diverse datasets. Within the European Union, such transfers are regulated under the General Data Protection Regulation, which permits transfers to third countries primarily on the basis of adequacy decisions under Article 45. This paper examines the role of adequacy decisions as a mechanism for enabling access to EU personal data and analyses the challenges faced by third countries in meeting the required standard of protection. It focuses on the concept of “essential equivalence” and the legal and institutional conditions that must be fulfilled in order to obtain adequacy status. The paper adopts a doctrinal approach, based on the analysis of EU legal sources and relevant case law, and situates these findings within the broader context of global data flows. It argues that the adequacy framework sets a high and complex threshold, which is difficult to meet in practice, particularly for countries with developing regulatory systems. In the context of AI development, this may limit access to data and affect the ability of third countries to participate in data-driven innovation, thereby influencing the structure of global data flows.