Transfer of personal data between the EU and Japan
SHARE
Transfer of personal data between the EU and Japan
It has long been a source of intrigue that the transfer of personal data to some ‘third countries’ such as Japan has not yet been deemed adequate by the EU. Article 45 of the General Data Protection Regulation ((EU) 2016/679) permits transfers of personal data to a third country or an international organisation where the European Commission decides there is an adequate level of protection.
However, on 23 January 2019, the European Commission adopted its adequacy decision finding that data protection standards in the EU and Japan are equivalent. In parallel, Japan adopted an equivalent decision, thereby creating the world’s largest area for safe personal data flows.
The EU has unilateral adequacy decisions with several other countries but this is the first time that the EU and a third country have agreed on a reciprocal recognition of the adequate level of protection.
Before the Commission adopted its adequacy decision, Japan put in place additional safeguards to ensure that personal data transferred from the EU will be protected in line with European Standards. These include:
- A set of Supplementary Rules that will bridge several differences between the EU and Japanese data protection systems including safeguards to protect sensitive data, the exercise of individual rights and the conditions under which EU data can be transferred from Japan to another third country. The Supplementary Rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese Personal Information Protection Commission (PPIC) and the courts.
- Japanese government assurances regarding safeguards over how Japanese public authorities access EU personal data for criminal law enforcement and national security purposes.
- A complaint-handling mechanism to investigate and resolve Europeans’ complaints over how Japanese public authorities access their personal data. The PPIC will administer and supervise this new mechanism.
For all businesses that trade with Japan, this decision will be a welcome step.
For more information about the safe transfer of personal data outside of the EEA or any other data protection queries, please contact me or any member of the data protection team on 023 8048 2482.