The EU does not recognise the sovereignty of Israel over the territories the country has occupied since 1967 (OTs) and applies a policy of differentiation vis-à-vis Israel and the OTs. In areas such as trade, origin labelling and EU-funded programmes, the EU has put measures in place to ensure that Israeli settlements in the OTs are not treated as part of Israel.

Likewise, the EU’s 2011 adequacy decision for Israel, which allows for the free flow of personal data, states in Article 2 that it should be applied in accordance with international law, i.e. excluding the OTs.

However, Israel treats the settlements as part of its territory for most purposes, including data transfer. There appears to be no guarantee in place to ensure that the Israeli Privacy Protection Authority and Israeli companies respect the territorial limitation of the EU adequacy decision, in particular with regard to onward data transfers.

1. Can the Commission confirm that there is no guarantee in place that prevents the flow of EU personal data to settlement-based companies, via both direct and onward transfers?

2. How will it fix this problem and ensure that these companies comply with the territorial provisions set out in the adequacy decision?

3. What effect does this have on the ongoing review of the adequacy decision?