IANAL, but last time I looked, german data protection law regarded the level offered by other states within the european economic area as adequate.