Across the European Union, there is broad agreement on one central point of internal security policy. Organised crime has become deeply transnational. Drug trafficking networks operate across continents, financial flows move through multiple jurisdictions, and criminal groups rely on logistics and communications infrastructures that rarely stop at EU borders. In response, the EU law enforcement strategy has increasingly emphasised upstream disruption. The objective is not merely to intercept criminal activity within the Union but to target the production, transit and coordination nodes that enable organised crime in the first place.
Achieving this objective depends heavily on the ability of authorities to exchange operational personal data with partners outside the EU. Information on suspects, communication patterns, financial movements, shipping logistics and criminal associations forms the foundation of modern investigations. Without the lawful and systematic exchange of such data, international cooperation becomes slower, more fragmented and less effective. In the EU legal order, the central mechanism designed to enable such exchanges is the adequacy decision under the Law Enforcement Directive. Yet the EU’s record in adopting these decisions is strikingly limited. Since the directive entered into effect in 2018, only one adequacy decision has been adopted. That decision concerns the United Kingdom and arose primarily from the legal necessity created by Brexit rather than from a strategic effort to expand cooperation with external partners.
This limited progress is increasingly difficult to reconcile with the EU’s operational ambitions. The Union’s law enforcement architecture includes institutions such as Europol, which supports cross-border investigations and intelligence analysis, and Eurojust, which coordinates judicial cooperation in complex criminal cases. More recently, the Union has established the European Public Prosecutor’s Office to prosecute crimes affecting the EU’s financial interests. Each of these bodies depends on cooperation with partners outside the EU in order to tackle transnational criminal networks effectively.
Despite this operational reality, the legal framework governing transfers of operational personal data remains cautious and fragmented. Both Europol and Eurojust can exchange such data with third countries where an adequacy decision exists, where a binding international agreement provides appropriate safeguards, or where safeguards are assessed in individual cases. While these mechanisms allow cooperation to continue, adequacy decisions remain the most stable and scalable legal foundation for systematic exchanges. They enable predictable transfers across multiple investigations and across all Member States without the need for repeated legal assessments.
Importantly, the need for additional adequacy decisions is not only recognised at EU institutional level. Member State authorities themselves have emphasised the issue during the ongoing review of the Law Enforcement Directive. In their collective position on the evaluation of the Directive, adopted by the Council in 2025, Member States note that only one adequacy decision has been adopted so far under the Directive and underline the operational consequences of this gap.
The Council position makes clear that adequacy decisions are an essential instrument for facilitating safe international transfers of personal data in the law enforcement context. It explicitly calls on the European Commission to take further meaningful and proactive steps towards adopting additional adequacy decisions for third countries and international organisations that meet the necessary criteria.
Member States also highlight the practical difficulties associated with relying on alternative mechanisms. In the absence of adequacy decisions, competent authorities must rely on assessments of “appropriate safeguards” for each transfer or invoke limited derogations available under the directive. In practice these mechanisms often require authorities to evaluate all circumstances surrounding the transfer, assess the legal framework of the receiving country and gather reliable information about safeguards that may not always be easy to verify.
According to the Council’s findings, many competent authorities consider these requirements difficult and burdensome to implement in practice. The result is legal uncertainty and administrative complexity that can slow down operational cooperation in cross-border investigations. From the perspective of national law enforcement authorities, adequacy decisions provide a far more practical and predictable solution.
This perspective from the Member States is significant. It demonstrates that the demand for adequacy decisions is not merely a theoretical policy argument but a concrete operational requirement expressed by the authorities responsible for conducting criminal investigations.
Another important reason why adequacy decisions matter lies in their EU wide effect. Bilateral police cooperation agreements remain an important element of international cooperation. However, they operate only for the parties that conclude them. A bilateral treaty between a Member State and a third country does not automatically facilitate cooperation for other Member States or for EU agencies.
As a result, reliance on bilateral agreements leads to a patchwork system in which operational capabilities differ across the Union. Some Member States may have extensive legal frameworks for exchanging data with a particular non-EU country while others may have none. This divergence can complicate joint investigations and create uneven operational capabilities within the EU.
Adequacy decisions provide the only mechanism capable of resolving this problem at Union level. Once adopted, an adequacy decision establishes that a third country provides an essentially equivalent level of data protection for law enforcement purposes. This determination applies across the entire EU legal order. All Member States, as well as EU agencies such as Europol, Eurojust, and the European Public Prosecutor’s Office, can rely on it as a stable legal basis for the transfer of operational personal data.
In this sense, adequacy decisions serve the needs of all stakeholders simultaneously. They enable national police and prosecutors to exchange operational data with foreign counterparts. They provide a clear legal foundation for EU agencies operating across multiple Member States. And they reduce the administrative burden associated with assessing safeguards on a case by case basis.
For investigations targeting transnational organised crime networks, this uniformity is particularly important. Criminal groups operate across multiple jurisdictions simultaneously. The legal framework governing law enforcement cooperation must therefore be capable of operating at the same scale.
The limited number of adequacy decisions adopted under the Law Enforcement Directive raises an obvious question. Why has progress been so slow?
One explanation may lie in the demanding standard applied to adequacy assessments. The directive requires that third countries provide an essentially equivalent level of protection for personal data. While this requirement reflects the EU’s commitment to strong data protection safeguards, it may also set a threshold that many operational partners find difficult to meet.
This issue is particularly relevant in the context of organised crime investigations. Many countries that play central roles in global drug supply chains or financial crime networks do not have legal systems identical to those of the EU. If adequacy is interpreted too rigidly, these jurisdictions may be effectively excluded from the adequacy framework even when operational cooperation with them is essential.
A second factor may be institutional caution. Adequacy decisions involve complex legal assessments and can carry political sensitivities. The Commission may be proceeding cautiously when considering potential candidates. However, the operational costs of this caution are becoming increasingly visible.
The experience with the United Kingdom demonstrates the practical importance of adequacy decisions. Without the adequacy decision adopted after Brexit, the exchange of operational data between EU authorities and UK law enforcement would have faced significant legal obstacles. That decision ensured continuity in one of the EU’s most important security partnerships. It also illustrates how adequacy can function as a strategic instrument enabling effective cooperation.
The EU’s fight against transnational organised crime increasingly depends on cooperation with countries located upstream in global supply chains. These include cocaine producing countries in Latin America, transit hubs in West Africa, cannabis resin suppliers in North Africa and coordination environments in the Middle East. Investigations targeting criminal networks that operate across these regions require rapid and legally secure exchanges of operational personal data.
In this context, adequacy decisions should not be viewed as purely technical data protection instruments. They represent essential infrastructure for international law enforcement cooperation. The position adopted by Member States during the review of the Law Enforcement Directive makes clear that national authorities recognise this need and are calling for a more proactive approach.
Expanding the use of adequacy decisions would strengthen legal certainty for Europol, Eurojust, the European Public Prosecutor’s Office and national authorities alike. It would reduce fragmentation across the Union and provide a stable foundation for cooperation with key partners. Most importantly, it would align the EU’s legal architecture with the transnational reality of organised crime.
03 April 2026
Rond Point Schuman 6 | Box 5
1040 Brussels | Belgium
info@privacynext.eu
Copyrights © 2026 PrivacyNext.eu | Privacy Policy | Cookie Policy Webdesign & Development by ALYS
