The EU and Japan have agreed to recognise each other's data protection regime as "equivalent", meaning, for EU-based businesses, the transfer of personal data to Japan will automatically be said to comply with the requirements of EU law.
The European Commission, which negotiated the deal with counterparts from Japan, said the "relevant internal procedures" have still to be completed to ratify the agreement. In the EU, this involves the Commission issuing a so-called 'adequacy' decision. Before that happens, EU data protection authorities, via the new European Data Protection Board (EDPB), will issue an opinion on the agreement.
EU data protection law puts restrictions on the transfer of personal data outside of the European Economic Area (EEA). One way in which organisations can transfer personal data outside of the trading bloc is where they do so to a country that benefits from a so-called 'adequacy decision' of the European Commission.
Countries that benefit from an adequacy decision are considered to have laws essentially equivalent to those that safeguard personal data inside the EEA. Where an adequacy decision has been issued, data transfers between the EU and those third countries are said to be automatically compliant with EU data protection laws. Canada, Switzerland and New Zealand are among the countries that benefit from a Commission adequacy decision.
Establishing a mutual adequacy arrangement with Japan will "create the world's largest area of safe transfers of data based on a high level of protection for personal data", the Commission said in a statement.
Japan has agreed to put in place a new mechanism for EU citizens to use to raise complaints regarding access to their data by Japanese public authorities, as well as a number of binding rules to safeguard EU citizens' data. These include new rules stipulating how Japan will protect "sensitive data", the circumstances in which EU citizens' data could be further transferred from Japan to a 'third country', and how those individuals can exercise their right to access their data and obtain rectification of any inaccuracies.
The EU's justice commissioner Věra Jourová said: "Japan and EU are already strategic partners. Data is the fuel of global economy and this agreement will allow for data to travel safely between us to the benefit of both our citizens and our economies. At the same time we reaffirm our commitment to shared values concerning the protection of personal data. This is why I am fully confident that by working together, we can shape the global standards for data protection and show common leadership in this important area."
The UK government has said it is seeking an enhanced version of an adequacy decision from the European Commission to help maintain data flows and regulatory cooperation with the EU on data protection post-Brexit.