The free flow of personal information between the European Union and Japan is now possible. On 23 January 2019, the European Commission adopted its adequacy decision on Japan. The decision was preceded by a long procedure of discussions and formal meetings and the recognition of each other’s data protection systems.
The tool of the adequacy decision allows for partnering states to enjoy equivalent protection in their data protection systems when the data is transferred, allowing individuals and companies to benefit from safe data flows. According to EU sources, the adequacy decision has created the world’s largest area of safe data flow.
The first steps of the mutual adequacy decision were taken back in July 2017 when the President of the Commission, Jean-Claude Juncker, and Prime Minister of Japan, Shinzo Abe came out with a joint statement, recognising “the importance of ensuring a high level of privacy and security of personal data as a fundamental right and as a central factor of consumer trust in the digital economy.”
The decision is also part of the EU strategy to promote international data protection standards after the implementation of the GDPR that came into effect in May 2018.
Key Elements of the Adequacy Decision of EU-Japan
The aim of the EU-Japan adequacy decision is to tie in the two data protection systems:
- The processing of data – Whenever data leaves the EU borders to Japan, the same guarantees apply as if the data never left the EU.
- Processing of data is limited to the purpose for which it was legally transferred unless EU citizens give their consent for another purpose, and the processing must be completed under appropriate security and protection measures;
- Data is kept accurate and up-to-date with additional safeguards for particularly sensitive data and is kept no longer than necessary for the purpose for which it was transferred; and
- Data is never further transferred to individuals or entities which do not guarantee an adequate level of protection unless the consent of EU citizens is obtained
- The provision of ‘Supplementary Rules’ – additional safeguards will be put in place in order for some of the differences in the processing of personal data to be avoided in the future. They will serve to strengthen the protection of sensitive data; facilitate the exercise of individual rights relating to the protection of personal data, and govern the conditions under which EU data can be further transferred from Japan to another third country.
- Enforcement and national security – The Japanese Government has given assurances to the Commission ensuring that the use of data for criminal law enforcement and national security purposes would be limited to what is necessary and proportionate subject to independent oversight and effective redress mechanisms.
Benefits of the Decision
On 1 February 2019 the EU-Japan Economic Partnership Agreement entered into force and from now on European companies could benefit from data processing activities within Japan. Moreover, the personal data of 127 million Japanese consumers is now easier to process for the European market.
The EU-Japan adequacy decision represents the efforts of Japan’s government to establish robust data privacy and security systems not only to maintain consumer trust but to be able to establish strategic commercial partnerships in an increasingly data-driven economy.