The European Commission adopted its adequacy decision for Japan on 23 January 2019, opening the doors for personal data to flow freely between the two major global economies.
The Adequacy Decision
Following two years of dialogue between the European Union (EU) and Japan, the European Commission (EC) adopted its mutual adequacy decision (Decision) for Japan on 23 January 2019. As noted in the EC’s press release, the decision is effective immediately.
Japan now joins a list of select jurisdictions recognised as adequate by the EC, notably: Andorra, Argentina, Canada (for private entities only), Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, and the United States (EU-U.S. Privacy Shield). The Decision is the first of its kind adopted since the General Data Protection Regulation (GDPR) became applicable in May 2018.
Prior to the adoption of the Decision, Japan introduced a set of supplementary rules to bring the safeguards applicable to EU data transferred to Japan in line with GDPR standards. These additional safeguards bridge the gap that previously existed between the Japanese and European data protection regimes and include: (1) the expansion of the Japanese definition of sensitive data; (2) steps to facilitate the exercise of individual rights of European data subjects in Japan; and (3) additional levels of protection for European data subjects to an onward transfer from Japan to another third country. Japan also agreed to establish a complaint-handling system, under the supervision of the Japanese Personal Information Protection Commission, to manage complaints from European data subjects regarding access to their data by Japanese public authorities.
The Decision represents a step further towards the EU’s announced strategy in the field of international data flows and protection set out in the Commission’s Communication on Exchanging and Protecting Personal Data in a Globalised World published in January 2017. The Decision is also well timed in advance of the EU-Japan Economic Partnership Agreement, which is on track to come into force on 1 February 2019 and which is generally anticipated to reduce barriers to trade increase flows of data between the two territories. According to a joint statement issued by Věra Jourová (Commissioner for Justice, Consumers and Gender Equality) and Haruhi Kumazawa (Commissioner of the Personal Information Protection Commission of Japan), “these mutual adequacy findings create the world’s largest area of safe data transfers. They build on the high degree of convergence between the two systems, which rest notably on an overarching privacy law, a core set of individual rights and enforcement by an independent data protection authority”.
The Decision covers all personal data transfers from the EEA (all EU members plus Iceland, Lichtenstein, and Norway) to Japan and, accordingly, EEA-based businesses no longer need to put in place Article 46 data exporting arrangements (such as the EU Model Clauses and Binding Corporate Rules) to cover such transfers.
Further information regarding the Decision can be found at the EC’s Fact Sheet — Questions and Answers on the Japan Adequacy Decision. (http://europa.eu/rapid/press-release_MEMO-19-422_en.htm).
