The European Commission and the Personal Information Protection Commission of Japan have agreed mutual adequacy decisions regarding the transfer of personal data. This is a significant development, and allows businesses to send personal data back and forth between the EEA and Japan without the need to implement additional data transfer mechanisms.

Overview

On 23 January 2019, the European Commission (the "Commission") adopted its adequacy decision ("Adequacy Decision") in respect of Japan. The Adequacy Decision allows personal data to be transferred from the European Economic Area ("EEA") (i.e., the 28 EU Member States as well as Norway, Liechtenstein and Iceland) to Japan. Japan’s Personal Information Protection Commission of Japan ("PPC") also published a notice which specifies that EEA Member States are included in Japan's data transfer "white list" on the same date. This is the final step in a process that began in September 2018 and required input from a range of stakeholders on both sides. The arrangement took immediate effect.

The processing of personal data in the EEA is governed by the General Data Protection Regulation ("GDPR"), which imposes a general prohibition on the transfer of personal data to recipients located outside the EEA. Similarly, Act on the Protection of Personal Information ("APPI"), Japanese data protection law, imposes restrictions on transfers of personal data out of Japan. While the EEA and Japan each have legal mechanisms for enabling businesses to transfer personal data to other countries, those mechanisms are often cumbersome and require considerable effort to implement in many cases.

The effect of the Adequacy Decision, and PPC's equivalent decision, is that personal data can flow between the EEA and Japan without the need to impose further safeguards (e.g., data transfer agreements). As such, transfers of personal data from the EEA to Japan are now as frictionless as intra-EEA transfers. Japan joins the list of 12 other countries that the European Commission currently recognises as providing adequate data protection. However, it should be noted that Adequacy Decisions are not permanent, and are subject to review under the GDPR.

The Adequacy Decision

Prior to the implementation of the Adequacy Decision, Japan introduced additional safeguards, to more closely match the protections that exist in the EEA. These included:

• A set of supplementary rules. PPC introduced Supplementary Rules under the Act on the Protection of Personal Information for the Handling of Personal Data Transferred from the EU based on an Adequacy Decision in September 2018 for additional safeguards to offer additional protections with respect to sensitive data, the exercise of individual rights, and the conditions under which personal data from the EEA can be transferred onward from Japan to a third country. These supplementary rules are binding under the APPI on data controllers that receive personal data from the EEA, and are enforceable by PPC and the Japanese courts.
• A complaint-handling mechanism. A mechanism for addressing complaints from EEA data subjects regarding access to their data by Japanese public authorities (e.g., security services and law enforcement agencies) will be implemented. This mechanism will be administered and supervised by PPC.
• Law enforcement and national security. The Japanese government has provided assurances that the processing of personal data for law enforcement and national security purposes will be limited to what is necessary and proportionate, and will be subject to independent oversight and effective redress mechanisms.

Impact on businesses

This is the first time that the European Commission has formally agreed bilateral and reciprocal recognition of adequacy with a third country. The Adequacy Decision is intended to make the flow of commerce between the EEA and Japan smoother and less complex than it has been in the past, and forms part of a wider strategy to boost trade between the EEA and Japan.

Click here to download PDF.

Kimberly Sharp (White & Case, Associate, London) contributed to the development of this publication.

[View source.]