Today the European Commission (the "EU Commission") authorized the free flow of personal data to Japan. This "adequacy decision," issued jointly with a mirroring decision by the Japanese government, allows personal data to transfer between the European Union (the "EU") and Japan freely and under strong guarantees of protection. The outcome of lengthy negotiations resulting in Japan strengthening its privacy rules to follow EU standards, the adequacy decision arrives a few days before the EU-Japan free trade agreement enters into force in February 2019.
How Did We Get Here?
Even though the EU already has unilateral adequacy decisions with several other countries (such as Argentina, Canada, Switzerland and, through the Privacy Shield, the United States), this is the first time the EU and a third country agreed on a mutual recognition of the adequate level of data protection.
The General Data Protection Regulation ("GDPR"), the EU privacy law that entered into force in May 2018, empowers the EU Commission to issue adequacy decisions when a foreign country or international organization provides a level of protection that is deemed adequately comparable to the EU privacy framework. An adequacy decision allows the free flow of data without the additional safeguards that would otherwise be necessary for outbound transfers— standard contract clauses, binding corporate rules, etc.
In making adequacy decisions, the EU Commission performs a comprehensive assessment of the guarantees offered under the domestic laws of its counterparty. Such an assessment uses criteria including, inter alia, the existence and effective functioning of data protection authorities and the ability of authorities to access the transferred data.
In the case of Japan, the negotiations concluded with changes to Japanese legislation, most notably, the introduction of wider individual privacy rights and the establishment of the Personal Information Protection Commission (the "PPC"), an independent supervisory authority. In addition, Japan adopted, under "supplementary rules," provisions imposing a higher standard for protecting personal data originating from the EU. These supplementary rules are legally binding and enforceable by the PPC.
Next Steps
With the adequacy decision entering into force immediately, companies can, as of today, rely on the EU adequacy decision as authorization to transfer personal data from the EU to Japan and vice versa. However, while the adequacy decision may be applicable indefinitely, it will be "continuously monitored" by the EU Commission. In fact, the decision itself states that it will be subject formally to periodic review,1 the first being in two years' time. If the level of privacy protection offered under Japanese law ever changes, the EU Commission may decide to amend or revoke its decision.
Footnote
1 As required by Art. 45 GDPR. For other reviews of this kind, see our Legal Update on the second review of the Privacy Shield.
Visit us at mayerbrown.com
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2019. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.