Introduction

On 19 July 2024, the Federal Competition and Consumer Protection Commission (FCCPC or Commission) in Nigeria imposed a fine of $220 million on Meta Platforms Inc (Meta), the parent company of WhatsApp LLC (WhatsApp), for violations of both the Federal Competition and Consumer Protection Act 2018 (FCCPA) and the Nigeria Data Protection Regulation 2019 (NDPR). In the investigation report that served as the basis for this penalty, the FCCPC formulated three main issues for determination. One of these issues was whether WhatsApp’s ‘business practices with respect to its data collection and management processes are excessive, unscrupulous, obnoxious and a deliberate tactic to exploit Nigerian consumers, contrary to the FCCPA and NDPR’. The FCCPC ruled in the affirmative on this issue.

 In this article, I examine this particular aspect of the FCCPC’s determination in relation to the provisions of the NDPR. Readers should note that in this review, I will endeavour to provide an objective and impartial analysis of this determination. My aim is to offer insights into the underlying analysis that informed the FCCPC’s determination on this issue and to assess whether this analysis is consistent with the proper interpretation of the NDPR in the light of evolving data processing operations.

 The legal basis for FCCPC’s determination

The FCCPC in reaching this particular determination exercised among others, its section 17 (a) power under the FCCPA. This provision charges the FCCPC with the responsibility of enforcing any other enactment related to competition and consumer protection in Nigeria. In exercising this authority, the FCCPC interpreted the NDPR as a consumer protection law. Although this interpretation of the FCCPC’s statutory function is novel in Nigeria and may be subject to scrutiny in appellate courts, there are persuasive case laws from the United States (U.S) where courts have recognised the Federal Trade Commission (FTC), the lead consumer protection agency in the U.S., as having broad data protection enforcement authority in instances where consumers are exploited. This authority is derived from section 5 of the FTC Act, which prohibits ‘unfair or deceptive acts or practices’—a phrase that closely parallels the term ‘obnoxious practices or the unscrupulous exploitation of consumers’ found in section 17(s) of the FCCPA.

While the scope of the FCCPC’s power to enforce the NDPR and address data privacy infringements as a form of consumer harm remains uncertain in Nigeria, the following U.S. cases may offer some guidance: FTC v. Wyndham Worldwide Corp., 10 F. Supp. 3d 602 (D.N.J. 2014); FTC v. Wyndham Worldwide Corp., 10 F. Supp. 3d 602, 609 (D.N.J. 2014); and FTC v. Wyndham Worldwide Corp., 799 F.3d 236, 247–48 (3d Cir. 2015). These cases originated from a single matter in which Wyndham Worldwide Corp., a hotel chain, contested FTC’s authority to enforce data security practices following a series of data breaches suffered by the hotel. Upon appeal to the U.S. Court of Appeals for the Third Circuit, the court upheld the FTC’s authority, holding that lax cybersecurity practices leading to a data breach fall within the ‘unfairness’ prong of the FTC Act. This decision affirmed the FTC’s jurisdiction to address and enforce violations related to data privacy.

It is crucial to emphasise that when the FCCPC chooses to exercise its consumer protection authority to enforce the NDPR, any subsequent determinations or outcomes resulting from such enforcement actions must be in strict adherence to both the spirit and letter of the NDPR.

Excessive data collection under the NDPR

Under the NDPR, one of the governing principles of data processing provided for in article 2.1 (1) b) is that personal data (processed) shall be ‘adequate, accurate and without prejudice to the dignity of human person’. The reference to the word ‘adequate’ means that personal data collected must be limited to the minimum necessary to achieve the intended processing purpose, ensuring that the data collected is proportionate to the purpose pursued by the processing operation.

This principle is otherwise referred to as data minimisation under the General Data Processing Regulation (GDPR) and in most jurisdictions with a data protection framework. This principle (and others provided for in the NDPR and in the Nigeria Data Protection Act 2023) must be complied with whenever personal data is processed irrespective of the lawful base. In essence, data minimisation requires that data controllers and processors collect and process only the personal data that is directly relevant and essential to accomplishing the specific purpose of the processing operation. Consequently, data controllers and processors must exercise diligence to refrain from collecting excessive personal data from data subjects (in this case WhatsApp users in Nigeria) beyond what is necessary to achieve the intended purpose of the data processing operation

 (Re)scrutinising the analysis of the FCCPC

As previously noted, one of the issues formulated by the FCCPC in determining that Meta violated the NDPR, and by extension the FCCPA, is:

Whether WhatsApp’s 2021 Updated Privacy Policy (Policy) and business practices with respect to its data collection and management processes are excessive, unscrupulous, obnoxious, or exploitative contrary to the FCCPA, including the mandate under [s]ection 17(a) regarding enforcing other enactments on competition and consumer protection.

As an initial matter, the reference to ‘other enactments on … consumer protection’ in this context should be understood as specifically referring to the NDPR. Consequently, the analytical framework that should be applied will be solely based on those established under the NDPR.

In its analysis, the FCCPC asserted that WhatsApp collects 44 metadata points, in contrast to Signal and Telegram, which collect only 4 metadata points each. Based on this comparison, the FCCPC questioned the necessity of such extensive data collection for providing WhatsApp-related services to users in Nigeria. While the FCCPC’s assertion regarding WhatsApp’s (meta)data collection practices may be accurate, it is essential to first establish that each of these metadata points constitutes personal data to trigger the application of the NDPR. For ease of reference, article 1.3 xix of the NDPR defines personal data as follows:

any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; It can be anything from a name, address, a photo, an email address, bank details, posts on social networking websites, medical information, and other unique identifier such as but not limited to MAC address, IP address, IMEI number, IMSI number, SIM, Personal Identifiable Information (PII) and others.

Although these metadata points were listed in Annexure 1 of the investigation report, it is improbable that all of them would be capable of identifying a natural person, either directly or indirectly, and thereby come within the meaning of personal data in the NDPR. An individual is identified when he is capable of being ‘distinguished’ or ‘singled out’ from among a group of persons, and identifiable when, ‘although the person has not been identified yet, it is possible to do’ so. From my perspective, it remains unclear to what extent the FCCPC has determined that each of the metadata points collected by Meta constitutes personal data capable of identifying an individual. If it can indeed be demonstrated that these metadata points qualify as personal data, then the FCCPC’s claim regarding the collection of such data, especially in comparison to platforms like Telegram and Signal, may be legitimate.

Another key consideration in assessing the FCCPC’s determination on this issue is the question of how ‘excessive’ WhatsApp’s data collection practices are, considering the specific factual scenario surrounding its data processing operations. This determination is not an abstract concept and should not rely merely on the recitation of provisions from the NDPR or general data protection principles. Instead, the FCCPC must present clear and objective evidence to substantiate its claims. The crux of the matter is not solely the volume of personal data collected; rather, it concerns whether any of these metadata points are not directly relevant and necessary for achieving the specific purpose of the processing operation conducted by WhatsApp.

In other words, WhatsApp’s data collection practices would be deemed excessive—and thus unnecessary in relation to the processing purpose—if it can be shown that the purpose could be accomplished without including certain metadata points (assuming they constitute personal data) in the collection or processing. Therefore, WhatsApp’s data collection practices would violate the data processing principle of being adequate as provided in article 2.1(1) b) of the NDPR if there is clear and convincing evidence demonstrating that the metadata points collected are not relevant to the provision of WhatsApp services to users in Nigeria.

In this context, it is noteworthy that the FCCPC did not provide a detailed analysis demonstrating how any of these metadata points are irrelevant to the services provided by WhatsApp in Nigeria. Instead, the FCCPC requested Meta to provide a log of all data points collected, along with an explanation of the necessity or otherwise of such data. This approach appears to fall short of the well-established evidentiary standard that ‘he who asserts must [convincingly] prove’ required to substantiate the claims of excessive data collection.

While it is pertinent to state that the National Information Technology Development Agency (NITDA) provided information which, according to the FCCPC indicated that:

certain data collected by Meta Parties were indeed necessary for the efficient provision of the service for which “consent” may be dispensed with; however, some other data collected were not necessary for the provision of WhatsApp services, and as such is excessive, optional, and unnecessary with respect to the service WhatsApp provides.

However, neither the FCCPC nor NITDA provided concrete details regarding the specific meta data points collected or how they were determined to be necessary or unnecessary for the provision of WhatsApp services. In my view, a thorough and detailed examination of these data points would have significantly strengthened the argument, demonstrating which metadata points are essential and which are not in the context of WhatsApp’s data collection practices related to the services provided to users in Nigeria. Meeting this evidentiary standard would undoubtedly bolster the FCCPC’s finding that WhatsApp engaged in excessive data collection practices, a claim that is more likely to be upheld upon appellate review.

A further point to consider in the FCCPC’s analysis of WhatsApp’s data collection practices is their statement from the above quotation which reads ‘certain data collected by Meta Parties were indeed necessary for the efficient provision of the service for which ‘consent’ may be dispensed with’. The ambiguity of this statement raises questions about whether the reference to ‘necessary’ pertains to any of the legal bases outlined in article 2 b), c), d), and e) of the NDPR, all of which incorporate the concept of necessity. Additionally, this statement seems to imply that consent as a legal basis could legitimise a data processing operation even if the data processed is not necessary for the purpose of the processing, thereby making it excessive. This approach is problematic, as consent is just one of several legal bases provided in the NDPR. The principle of data minimisation, which requires that data collected be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed, applies universally to all data processing operations, regardless of the legal basis.

Lastly, the FCCPC’s assertion that ‘Meta Parties went beyond what is necessary for service delivery, and such data including device fingerprinting may be shared with third parties and commercialised’, suggests that device fingerprinting is one of the unnecessary metadata points, and its collection by WhatsApp constitutes excessive data collection. This assertion is problematic for two key reasons. First, ‘device fingerprinting’ is not listed in Annexure 1 of the investigation report, which lists the metadata points collected by WhatsApp. Second, and more importantly, from a technical perspective, device fingerprinting is not a type of data or metadata point. Rather, it is a technological method used to gather certain information—such as screen resolution, browser settings, or operating system specifics—about a mobile device or terminal equipment used by an individual to access the internet.

 Conclusion

In conclusion, the FCCPC’s determination that WhatsApp engaged in excessive data collection practices under the NDPR raises significant questions about the adequacy and relevance of the metadata points processed by WhatsApp in Nigeria. The Commission’s analysis, while highlighting disparities in the volume of data collected by WhatsApp compared to other instant messaging service like Signal and Telegram, fails to adequately consider the unique characteristics of each service and the distinct technical infrastructures underlying their data processing operations. Additionally, it does not comprehensively address the critical issue of whether these metadata points constitute personal data within the meaning of the NDPR. Furthermore, the FCCPC’s reference to the concept of necessity, particularly in the context of consent, appears somewhat ambiguous and potentially inconsistent with the principle of data minimisation that underpins the governing principle of personal data processing being adequate under the NDPR.

 The FCCPC’s approach to enforcing data privacy laws through the lens of consumer protection is novel in Nigeria and could set a significant precedent. However, the lack of concrete evidence and detailed analysis in the Commission’s findings may present substantive challenges during an appellate review. As the case is currently under review at the Competition and Consumer Protection Tribunal the outcome will no doubt be pivotal in determining the scope of the FCCPC’s authority to enforce data privacy laws as a form of consumer protection. The ramifications of this case could significantly influence the future enforcement of data privacy laws in Nigeria, particularly regarding the interpretation of the NDPR in the context of a consumer harm.

As we await the Tribunal’s decision, it will be interesting to see how the arguments presented by both parties will shape the evolving interconnectedness between data protection and consumer protection in Nigeria. The outcome of this case could either reinforce the FCCPC’s role in safeguarding consumer privacy or necessitate a recalibration of how data privacy laws may be enforced as a consumer protection law in Nigeria.

Introduction

On 28 November 2023, the Federal High Court (the Court) delivered its judgment in the case of Ikigai v National Information Technology Development Agency Suit No. FHC/ABJ/CS/1246/2022. The Plaintiff, Ikigai, a non-profit organisation, requested the Court to interpret the provisions of the Nigerian Data Protection Regulations 2019 (NDPR) and the Nigerian Data Protection Regulations 2019: Implementation Framework (Implementation Framework) concerning international data transfers.

In this article, I analyse this case and discuss its possible ramifications for international data transfers from Nigeria and the criteria to be used when assessing the adequacy of the level of protection of personal data in a third country.

Why adequacy assessment

Personal data is a critical input in the global digital economy and its international transfer is essential for the provision of various services and benefits to individuals. However, such transfers also pose significant challenges and risks for the protection of personal data and the rights of data subjects, especially when the data is intended to be processed in countries that have different or lower standards of data protection than the country of origin. Consequently, international data transfers are subject to rigorous oversight by privacy regulators and Data Protection Authorities (DPAs) due to these privacy risks. An example of this scrutiny is the decision of the Court of Justice of the European Union (CJEU) in CJEU Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, which invalidated the European Commission’s Privacy Shield Decision, the international data transfer framework between the US and EU, due to the invasive nature of US surveillance programmes, thus rendering transfers of personal data based on the Privacy Shield Decision unlawful.

Adequacy assessment is a mechanism to ensure that international data transfers are conducted in a way that respects the privacy and security of personal data and the fundamental rights and freedoms of data subjects. It involves the evaluation of the level of data protection in a third country by a DPA, to determine whether it is comparable to the level of data protection provided in the country of origin. If a third country is deemed to have an adequate level of data protection, data can be transferred to that country without any additional safeguards or authorisations. This simplifies international data transfers and reduces the administrative and legal burden for the data exporters and importers.

Adequacy assessment is important for several reasons. First, it promotes the harmonisation and convergence of data protection standards and practices across different jurisdictions, which can enhance the trust and cooperation among DPAs, consumers, and other stakeholders. Second, it eliminates digital trade restrictions to the free flow of data in cross-border business transactions, which can benefit the economy and society. Third, it safeguards the rights and interests of data subjects, who can enjoy the same level of data protection regardless of where their data is transferred or processed.

However, adequacy assessment is beset with some challenges and limitations. For example, it requires a comprehensive and rigorous analysis of the legal and institutional framework, the enforcement and oversight mechanisms, and the international commitments and obligations of the third country. In some cases, it requires continuous monitoring and review of the adequacy decision, which can be revoked or suspended if the level of data protection in the third country changes or deteriorates. Moreover, it may be affected by political and diplomatic factors, as well as by judicial interpretations and decisions, such as the judgment under review in this article and the EU case of Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (supra).

Legal framework for international data transfers under the NDPR and Implementation Framework

Under the NDPR, there are, in principle, two ways in which the transfer of personal data to third countries or international organisations is permissible. International transfers of personal data may take place on the basis of: an adequacy decision (art. 2.11); or, in the absence of such an adequacy decision, where an exemption applies (art. 2.12). Under the Implementation Framework, Binding Corporate Rules (BCRs) and Standard Contractual Clauses (SCCs) are introduced under art. 7.3 as an international data transfer mechanism where an organisation seeks to transfer personal data to another entity within its group of companies or an affiliate company.

According to art. 2.11 a) of the NDPR, the Attorney General of the Federation (AGF) supervises the transfers of personal data from Nigeria to a third country or an international organisation, which can only take place if the National Information Technology Development Agency (the Agency or NITDA) determines that the third country ensures an adequate level of protection for the personal data. The Agency has not yet defined what constitutes an ‘adequate level of protection’ for personal data. However, when evaluating the adequacy of protection, art. 2.11 b) of the NDPR requires the AGF to take into account the legal system of the third country, particularly in relation to rule of law, human rights and fundamental freedoms, relevant legislation in various areas, such as public security, defence, national security and criminal law, and the access of public authorities to personal data.

Additionally, art. 2.11 c) – e) of the NDPR requires the AGF and/or the Agency to consider other matters, such as: the implementation of the legislation, data protection rules, professional rules and security measures, including the rules for the onward transfer of personal data to another country (or recipient); the case-law, the effective and enforceable data subject rights and the effective administrative and judicial redress for the data subjects whose personal data are transferred; the existence and effective functioning of one or more independent supervisory authorities in the third country or organisation, with the responsibility for ensuring and enforcing compliance with the data protection rules, assisting and advising the data subjects in exercising their rights and cooperating with the relevant authorities in Nigeria; and the international commitments or obligations of the third country or organisation arising from legally binding conventions or instruments or from its participation in multilateral or regional systems, particularly in relation to the protection of personal data.

In transferring personal data abroad, art. 7.1 of the Implementation Framework stipulates that the following information is required: the list of countries where the personal data of Nigerian citizens and residents is transferred in the regular course of business; the data protection laws and the relevant data protection office/administration of those countries; the NDPR-compliant privacy policy of the data controller; an overview of the encryption method and data security standards; and any other detail that ensures the adequate protection of the privacy of personal data in the target country. Art. 7.2 also states that the Agency shall coordinate transfer requests with the AGF. To implement this provision, a positive adequacy decision in the form of a White List containing a list of countries that provide an adequate level of protection for personal data was established in Annexure C to the Implementation Framework. If the international data transfer is to a third country that is not on the White List, the data controller must ensure the lawfulness of such transfers, either by obtaining the consent of the data subjects or by relying on one of the exceptions provided in art. 2.12 of the NDPR. After the Agency determines that a third country provides an adequate level of protection for personal data, the transfer of personal data from Nigeria to that country becomes lawful and unrestricted.

Facts of Ikigai v NITDA and the decision of the Court

Ikigai filed a lawsuit against the Agency on 28 July 2022, seeking the interpretation of several provisions of the NDPR and Implementation Framework pertaining to international data transfers. One of the questions that the Plaintiff raised for the determination of the Court was whether the Agency, as the Defendant, was subject to the NDPR and Implementation Framework with respect to the international transfers of personal data from Nigeria to a third country and whether the NDPR and Implementation Framework mandated the Agency to grant a positive adequacy decision in the White List to only to countries that ensured an adequate level of protection for the personal data. On this basis, the Plaintiff among other reliefs, sought a declaration from the Court that Algeria, Comoros, Guinea Bissau, India, Mauritania, Mozambique, Sierra Leone, Togo and Zambia, which were included in the White List, did not provide an adequate level of protection for personal data, due to the lack of a data protection law and/or a data protection authority (DPA) in those countries. The Plaintiff also sought from the Court a declaration invalidating the BCRs and SCCs, and the White List as specified in Annexure C of the Implementation Framework.

In the main hearing, Ikigai among other things contended (and I agree) that it is impossible to assess the adequacy of protection for personal data in a country that lacks both a data protection law and an independent data protection authority. This according to Ikigai is violatory of art. 2.11 of the NDPR and art. 7.0 of the Implementation Framework. The Court sided with Ikigai by stating that the Agency, when conducting an adequacy assessment for the purpose of international data transfers, must consider the third country’s ‘Data Protection Law, Rule of law, respect for human rights, implementation of data protection rules, the existence of an independent data protection authority and its international commitments’.

Moreover, the Court held that, according to the NDPR and the Implementation Framework, the Agency had to consider the third countries contained in the White List as offering an adequate level of protection for personal data. The Court asserted that this was a mandatory condition of art. 2.11 of the NDPR and art. 7.0 – 7.2 of the Implementation Framework. In the light of this, the Court concluded that the inclusion of Algeria, Comoros, Guinea Bissau, India, Mauritania, Mozambique, Sierra Leone, Togo and Zambia in the White List is null and void since these countries lacked a data protection law or a DPA, and thus did not ensure an adequate level of protection within the meaning of art. 2.11 of the NDPR and art. 7.0 of the Implementation Framework that govern the process of international data transfers from Nigeria. The Court also stated that non-compliance with these provisions deprived the data subjects in Nigeria whose personal data were transferred to these countries of their enforceable data subject rights and their effective administrative and judicial redress mechanism. This consequently violated the right of privacy of Nigerians under section 37 of the Constitution of the Federal Republic of Nigeria (the Constitution).

Finally, the Court held that the use of BCRs and SCCs as mechanisms for international data transfers, as established under art. 7.3 of the Implementation Framework, was invalid since they were not provided for in arts. 2.11 – 2.12 of the NDPR, and thus exceeded the powers of the Agency under the NDPR. The Court based its decision on the case of Amasike v Registrar General Corporate Affairs Commission (2010) 13 NWLR (Pt. 1211) at 399, where the Supreme Court of Nigeria stated that ‘a public body or authority with statutory powers must act lawfully and avoid exceeding or abusing its powers. It must remain within the boundaries of the authority granted to it’.

Considering this and other factors, the Court granted all the reliefs requested by the Plaintiff Ikigai.

Implications for the future of international data transfers in Nigeria

The Court’s decision implies that under the NDPR, any international data transfers from Nigeria to third countries can no longer be made based on the White List. Moreover, any other country that lacks a data protection law and/or a DPA would also likely fail to meet the adequacy requirement and, therefore, any transfer of personal data from Nigeria to that country would be unlawful as well unless an exemption provided for in art. 2.12 applies. Therefore, it is recommended that before transferring personal data to third countries, data controllers in Nigeria must first confirm that a positive adequacy decision has been made by the Agency in respect of that country, or alternatively rely on any one of the exemptions provided in art. 2.12 of the NDPR. Otherwise, the transfer may be contested by data subjects as unlawful. Moreover, if such a legal challenge succeeds, the data subject may also claim compensation if there is a clear showing that the transfer breaches the constitutional right to privacy.

Furthermore, data protection compliance organisations (DPCOs) should be aware that, without any guidance from the Nigerian Data Protection Commission (the Commission), they must properly justify the legal basis of any international data transfers conducted by the companies they audit in the data protection audit report to be filed with the Commission annually. It should also be noted that the NDPR remains in force alongside the Nigeria Data Protection Act 2023 (NDPA), which led to the Agency’s transformation into the Commission. Therefore, any reference to the Agency in this article should be interpreted as a reference to the Commission for the purposes of the NDPA and NDPR.

Under the NDPA, the procedure for international data transfers is similar in some parts to the NDPR, and the lawfulness of such transfers depends on whether the third country or recipient complies with a law, BCRs, SCCs, code of conduct, or certification mechanism that ensures an adequate level of protection for the personal data (section 41 (1) (a)), or if an exemption applies (section 43 (1)). Section 42 (2) requires the Commission to consider the following factors when assessing the adequacy of the level of protection: the availability and enforceability of data subject rights, the possibility of a data subject to seek administrative or judicial redress, and the rule of law; the existence of a suitable instrument between the Commission and a competent authority in the recipient jurisdiction that guarantees adequate data protection; the access of a public authority to personal data; the existence and effectiveness of a data protection law; the existence and operation of an independent, competent data protection, or similar supervisory authority with sufficient enforcement powers; and the international obligations and agreements binding on the relevant country and its participation in any multilateral or regional organisations.

As of the date of this writing, the Commission is yet to exercise its power under the NDPA to designate any third country as providing an adequate level of protection, nor has it endorsed any BCRs, SCCs, codes of conduct, certification mechanisms or other instruments for international data transfers. Consequently, to ensure the legality and permissibility of international data transfers under the NDPA, the data controller (and/or processor) must rely on one of the exemptions provided for in section 43 (1).

Conclusion

Following the Court’s judgment in this case, the Commission is expected to conduct adequacy assessments of third countries and issue positive adequacy decisions that will enable unrestricted data transfers from Nigeria to these countries. Unfortunately, adequacy assessment was not mentioned in the Nigeria Data Protection Strategic Roadmap and Action Plan (NDP-SRAP) 2023-2027.

To this end, the Commission should as a matter of priority adopt a proactive and cooperative approach to adequacy assessments, by consulting with data controllers, processors, DPAs of the third countries, data subjects and other concerned stakeholders, and by reaffirming its adherence to the principles and standards established in both the NDPA and NDPR. A positive adequacy decision by the Commission must rely on core data protection principles present in the legal framework of that third country that align with those stipulated in the NDPA and the NDPR. It must also indicate the scope of its applicability, whether national or sectoral, and the identity of an independent public authority in charge of enforcing the data protection rules. It is further recommended that the Commission establish a robust framework to oversee and evaluate its adequacy decisions on an ongoing basis and be ready to respond to any changes or challenges that may emerge.

In conclusion, international data transfers are a vital component of the global digital economy and digital society. Therefore, DPAs must conduct adequacy assessments for international data transfers, in compliance with the applicable legislative frameworks. Adequacy assessments are a means of ensuring that the personal data of data subjects is safeguarded throughout its transit, irrespective of its destination. Finally, it must be emphasised that adequacy assessment is not only a legal requirement, but also of strategic importance for the Commission, as it can enhance its reputation, influence, and impact in the global data protection landscape.