The European Commission has adopted the adequacy decision for Japan to create, in their words, “the world’s largest area of safe data flows”.
An adequacy decision is a decision taken by the European Commission establishing that a third country provides a comparable level of protection of personal data to that in the European Union, through its domestic law or its international commitments. Although the EU has a number of unilateral adequacy decisions in place this is the first time that mutual recognition with a third country has been adopted.
Adoption is the last stage in the formal process that began in September 2018 following talks on reciprocal adequacy that ended successfully in July 2018. Although the Japanese data protection regime had been converging with EU law over recent years, driven by a recognition that data protection is a fundamental right, the adoption of the decision was only confirmed after Japan put in place three additional safeguards for data imported from the EU:
- Supplementary Rules to bridge several differences between the two data protection systems strengthening areas such as the protection of sensitive data, the exercise of individual rights and the conditions under which EU data can be further transferred from Japan to another third country. These rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.
- Further safeguarding assurances concerning access to EU data for criminal law enforcement and national security purposes. Any such use of personal data should be limited to what is necessary, proportionate, subject to independent oversight and open to effective redress mechanisms.
- A complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. Any complaints will be handled by the Japanese independent data protection authority.
The decision applies as of today but will be reviewed by both parties in two years’ time with subsequent reviews scheduled for every four years.
The full statement, press release and helpful Q&A documents are available on the Europa website.
