International data flows: Commission launches the adoption of its adequacy decision on Japan

Commissioner Jourová today briefed the College on the next steps and the Commission is publishing the draft adequacy decision and the related documents. This includes the additional safeguards that Japan will apply to EU personal data transferred to Japan, as well as commitments regarding access to personal data by Japanese public authorities for law enforcement and national security purposes, guaranteeing that their level of data protection is adequate to that of the EU’s. Japan is also going through a similar process to recognise the EU’s data protection framework.

Věra Jourová, Commissioner for Justice, Consumers and Gender Equality said: “We are creating the world’s largest area of safe data flows. Personal data will be able to travel safely between the EU and Japan to the benefit of both our citizens and our economies. Our partnership will promote global standards for data protection and set an example for future partnerships in this key area.”

Each side is now going through its internal procedures towards the final adoption of its reciprocal adequacy finding. For the EU, this involves obtaining an opinion from the European Data Protection Board (EDPB) and the green light from a committee composed of representatives of the EU Member States. Once this procedure will have been completed, the Commission will adopt the adequacy decision on Japan. The key elements of the adequacy decision To guarantee a level essentially equivalent to European standards, Japan has committed to implementing the following additional safeguards to protect personal data transferred to Japan, before the Commission formally adopts its adequacy decision:

• A set of rules providing individuals in the EU whose personal data are transferred to Japan, with additional safeguards that will bridge several differences between the two data protection systems. These additional safeguards will strengthen, for example, the protection of sensitive data, the conditions under which EU data can be further transferred from Japan to another third country, the exercise of individual rights to access and rectification. These rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.
• The Japanese government also gave assurances to the Commission regarding safeguards concerning the access of Japanese public authorities for criminal law enforcement and national security purposes, ensuring that any such use of personal data would be limited to what is necessary and proportionate and subject to independent oversight and effective redress mechanisms.
• A complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.

Europeans will benefit from strong protection of their personal data in line with EU privacy standards when their data is transferred to Japan. This arrangement will also complement the EU-Japan Economic Partnership Agreement as European companies will benefit fromfree data flows with this key commercial partner, as well as from privileged access to the 127 million Japanese consumers. The EU and Japan affirm that, in the digital era, promoting high privacy and personal data protection standards and facilitating international trade must and can go hand in hand. Next steps The draft adequacy decision will now go through the following procedure:

• Opinion from the European Data Protection Board (EDPB)
• Consultation of a committee composed of representatives of the Member States (comitology procedure)
• Update of the European Parliament Committee on Civil Liberties, Justice and Home Affairs
• Adoption of the adequacy decision by the College of Commissioners.

Background As announced in January 2017 in its Communication on Exchanging and Protecting personal data in a globalised world, the Commission launched a dialogue with the aim of reaching an adequacy decision with Japan. On 17 July 2018, the EU and Japan successfully concluded their talks on reciprocal adequacy. They agreed to recognise each other’s data protection systems as adequate, which will allow personal data to be transferred safely between the EU and Japan. The processing of personal in the EU is based on the General Data Protection Regulation, which provides for different tools to transfer personal data to third countries, including adequacy decisions.