On 23 January 2019, the European Commission adopted an adequacy decision for Japan, with immediate effect. The decision certifies Japan as having a comparable level of data protection to that of the European Union.
On the same day, Japan adopted an equivalent decision regarding the EU's data protection regime. This is the first example of mutual recognition of the adequate level of data protection.
According to Věra Jourová, European Commissioner for Justice, Consumers and Gender Equality, the mutual adequacy findings have created "the world's largest area of safe data transfers". Data is now able to flow freely between the EU and Japan without the need for further safeguards or authorisations. Ms. Jourová recognised the decision as providing "an example for future partnerships in this key area" and setting "global standards".
The adequacy decision
In order to align itself with EU standards, Japan introduced a number of additional safeguards. These include:
- Supplementary rules, adopted by Japan's independent data protection authority, the Personal Information Protection Commission (PPC). The rules bridge the differences between the two data protection regimes by providing for a higher level of protection of individuals' rights. The rules are binding on Japanese companies that receive EU data based on the adequacy decision, and are enforceable by the PPC and the Japanese courts.
- Safeguards for public authority access to personal data. Assurances were given to the European Commission regarding safeguards concerning Japanese public authorities' access to personal data for criminal law enforcement and national security purposes. Such access is limited to what is necessary and proportionate.
- Complaints mechanism. The PPC will administer and supervise a new mechanism for investigating and resolving complaints from Europeans regarding access to their data by Japanese public authorities.
Comment
Japan's adequacy decision complements the EU-Japan Economic Partnership Agreement, which will enter into force in February 2019, by facilitating commercial exchanges. This demonstrates a clear relationship between international trade, and the protection of personal data, while acknowledging that dialogues about each issue must remain separate.
The adequacy decision will be reviewed by the European Commission after two years. After this, a review will take place every four years.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.