January 28, 2019

The Commission has adopted its adequacy decision on Japan, allowing personal data to flow freely between the two economies on the basis of strong protection guarantees.

This is the last step in the procedure launched in September 2018, which included the opinion of the European Data Protection Board (EDPB) and the agreement from a committee composed of representatives of the EU Member States. Together with its equivalent decision adopted today by Japan, it will start applying immediately.

Before the Commission adopted its adequacy decision, Japan put in place additional safeguards to guarantee that data transferred from the EU would enjoy protection guarantees in line with European standards. This includes:

• a set of rules (Supplementary Rules) to bridge differences between the two data protection systems. These additional safeguards are designed to strengthen the protection of sensitive data, the exercise of individual rights and the conditions under which EU data can be further transferred from Japan to another third country. These Supplementary Rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority and courts;
• the Japanese government giving assurances to the Commission regarding safeguards concerning the access of Japanese public authorities for criminal law enforcement and national security purposes, ensuring that any such use of personal data would be limited to what is necessary and proportionate and subject to independent oversight and effective redress mechanisms; and
• a complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.

The adequacy decision also complements the EU-Japan Economic Partnership Agreement, which will enter into force in February 2019.

After two years, a joint review will be carried out to assess the functioning of the framework. This will cover all aspects of the adequacy finding, including the application of the Supplementary Rules and the assurances for government access to data. The EDPB will participate in the review regarding access to data for law enforcement and national security purposes. Subsequently, a review will take place at least every four years. To read the Commission’s press release in full, click here.