On July 6, 2018, the European Union and Japan successfully concluded talks on mutual recognition of data protection regimes. The EU has reached unilateral adequacy decisions with other countries, but this is the first time that a reciprocal agreement has been reached between the EU and a third country (i.e., a non-EU Member State) and will allow unhindered data transfers between the EU and Japan, creating the world’s largest area of safe data flows.
An adequacy decision is one of the tools provided for under the General Data Protection Regulation (“GDPR”) and is a finding made by the European Commission to confirm that the legislation and systems in place in a third country provide a comparable level of protection to that in the EU, such that personal data can be transferred safely between that third country and countries in the European Economic Area (the 28 EU Member States, Norway, Liechtenstein, and Iceland) without the imposition of further authorizations. It does not require the third country’s data protection regime to be identical to the EU’s, rather, the decision is based on the standard of “essential equivalence,” which involves a comprehensive assessment of a catalog of elements of the country’s data protection framework, including the relevant oversight and redress mechanisms available.
Like the EU (which brought the GDPR into force at the end of May 2018), Japan has recently revamped its data rules under the Japanese Act on the Protection of Personal Information (“APPI”). The data agreement recognizes the commonality of the two new regimes; for example, the updated APPI, which came into force last year, established the Personal Information Protection Commission in Japan as a dedicated body for enforcement of privacy regulations, and Article 51 of the GDPR requires Member States to have an independent public authority responsible for data protection. However, Japan has also agreed to additional safeguards with respect to EU citizens’ data, such as strengthening the conditions under which EU data can be further transferred from Japan to another third country, and the implementation of a complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities.
Now that negotiations have concluded, the EU will commence its relevant internal procedures for the adoption of its adequacy finding, after which the decision is expected to be formally adopted later this year. Japan will simultaneously take steps to finalize the data agreement.
The data agreement between the two sides comes as the EU and Japan sign two landmark deals to boost bilateral relations at the 25th EU-Japan Summit in Tokyo. The Strategic Partnership Agreement will provide a legally binding framework for cooperation between the EU and Japan across a broad range of areas of mutual interest and concern, including cyber-crime, disaster management, energy security, climate change, and aging populations. The Economic Partnership Agreement (“EPA”) is the biggest free-trade deal ever negotiated by the EU and eliminates tariffs on nearly all major goods traded between the two sides, creating an open trade zone covering countries that together account for approximately 30% of global GDP. The EPA is also the first EU trade agreement to include a specific commitment to the Paris climate agreement.
