Out-Law Analysis | 17 Sep 2018 | 1:25 pm | 4 min. read
On 5 September, the European Commission published a draft 'adequacy decision' which, if finalised, would confirm Japan as one of a small number of countries and territories deemed by the Commission to have data protection safeguards essentially equivalent to those in place in the EU.
Japan is also in the process of formalising a reciprocal finding. Together, the measures promise to facilitate the free flow of personal data by organisations trading in both the EU and Japan and give those businesses comfort that their data transfer arrangements comply with both EU and Japanese law.
However, there remain further steps to be taken before the deal on data protection that was first agreed in July takes effect.
The purpose of an 'adequacy decision'
EU data protection law puts restrictions on the transfer of personal data outside of the European Economic Area (EEA). One way in which organisations can transfer personal data outside of the trading bloc is where they do so to a country that benefits from a so-called 'adequacy decision' of the European Commission.
Countries that benefit from an adequacy decision are considered to have laws essentially equivalent to those that safeguard personal data inside the EEA. Where an adequacy decision has been issued, data transfers between the EU and those third countries are said to be compliant with EU data protection laws. For example, Canada, Switzerland and New Zealand are among the countries that benefit from a Commission adequacy decision.
Establishing a mutual adequacy arrangement with Japan will "create the world's largest area of safe transfers of data based on a high level of protection for personal data", the Commission previously said.
Earlier this month, the Commission took the important step of commencing the procedure for the adoption of its adequacy decision for Japan.
At the time, EU justice commissioner Věra Jourová announced the publication of the Commission's draft adequacy decision in addition to related documents which highlight additional safeguards that Japan will apply to EU personal data transferred to Japan, as well as commitments regarding access to personal data by Japanese public authorities for law enforcement and national security purposes.
The measures are aimed at guaranteeing that Japan's level of data protection is equivalent to that of the EU's. Japan is also going through a similar process to recognise the EU's data protection framework.
In a statement, Jourová said: "We are creating the world's largest area of safe data flows. Personal data will be able to travel safely between the EU and Japan to the benefit of both our citizens and our economies. Our partnership will promote global standards for data protection and set an example for future partnerships in this key area."
Each side is now going through its internal procedures towards the final adoption of its reciprocal adequacy finding.
For the EU, this includes obtaining an opinion from the European Data Protection Board (EDPB) and the green light from a committee composed of representatives of the EU member states.
Once all the procedures have been completed, the Commission will be able to formally adopt the adequacy decision on Japan.
To guarantee a level essentially equivalent to European standards, Japan has committed to implementing the following additional safeguards to protect personal data transferred to Japan, before the Commission formally adopts its adequacy decision:
Paloma Bru, Paula Fernández-Longoria and Teresa Castro Levya are Madrid-based data protection law experts at Pinsent Masons, the law firm behind Out-Law.com.