EU-Israel adequacy agreement and use of personal data in Gaza

16.1.2025

Question for written answer  E-000176/2025
to the Commission
Rule 144
Aodhán Ó Ríordáin (S&D), Matjaž Nemec (S&D)

Under Chapter 5 (Articles 45-50) of the General Data Protection Regulation (GDPR), personal data transfers from European Economic Area (EEA) countries to non-EEA countries rely heavily on adequacy decisions, which require the non-EEA country to demonstrate ‘an adequate level of protection’ for personal data. Israel was granted adequacy in 2011 under the Data Protection Directive (1995), based on Opinion 6/2009 of the Article 29 Data Protection Working Party.

Recent reports indicate the Israeli military has used Palestinians’ personal data, such as the population register and mobile location data, to target individuals in Gaza. Article 45(2) of the GDPR obliges the Commission to assess broader human rights implications, including the rule of law, fundamental freedoms and enforceable rights for affected individuals.

The ongoing use of personal data in ways contrary to GDPR principles – such as large-scale surveillance, inadequate legal bases, lack of transparency and insufficient data subject protections – raises serious questions about Israel’s compliance with adequacy conditions.

Given these concerns, will the Commission reassess Israel’s adequacy status in the light of potential violations of GDPR principles and human rights, and give details of the steps that are being taken to ensure adherence to EU standards?

Submitted: 16.1.2025