Japan joins list of EU-approved countries for data transfers

The European Commission announced on Wednesday that it has adopted a new 'adequacy decision' to recognise Japan's data protection regime as essentially equivalent to that in place in the EU. It applies to "all transfers of personal data to business operators in Japan", it said.

EU data protection law puts restrictions on the transfer of personal data outside of the European Economic Area (EEA). One way in which organisations can transfer personal data outside of the trading bloc is where they do so to a country that benefits from a so-called 'adequacy decision' of the European Commission.

Countries that benefit from an adequacy decision are considered to have laws essentially equivalent to those that safeguard personal data inside the EEA. Where an adequacy decision has been issued, data transfers between the EU and those third countries are said to be compliant with EU data protection laws. Canada, Switzerland and New Zealand are among the countries that benefit from a Commission adequacy decision, and such a decision also underpins the EU-US Privacy Shield.

Now Japan has been added to the list of countries and territories designated under the EU's adequacy framework. Japan has taken similar steps to recognise the EU as meeting its data protection standards, in a move that should help Japanese companies comply with Japanese law more easily when transferring personal data to the EU.

The new mutual adequacy arrangement with Japan "creates the world's largest area of safe data flows", EU justice commissioner Věra Jourová said.

"Europeans' data will benefit from high privacy standards when their data is transferred to Japan," Jourová said. "Our companies will also benefit from a privileged access to a 127 million consumers' market. Investing in privacy pays off; this arrangement will serve as an example for future partnerships in this key area and help setting global standards."

According to the European Commission, Japan has taken a number of steps to "guarantee that data transferred from the EU enjoy protection guarantees in line with European standards".

"These safeguards will bridge certain differences between the two data protection systems: for instance the Japanese definition of sensitive data will be expanded, the exercise of individual rights will be facilitated, and the further transfer of Europeans' data from Japan to another third country will be subject to a higher level of protection," the Commission said.

Japan has also provided assurances concerning the access its authorities will have to data transferred from the EU for "criminal law enforcement and national security purposes", the Commission said. Access to data for those purposes will be subject to "independent oversight and effective redress mechanisms", and a complaint-handling mechanism will be operated by Japan's data protection authority.

Data protection law expert Michele Voznick of Pinsent Masons, the law firm behind Out-Law.com, welcomed the new adequacy decision and highlighted the fact that Japan is the first country to benefit from such a decision under the General Data Protection Regulation (GDPR). Voznick said, though, that the prospect of 'no deal' Brexit raises uncertainty over the future two-way flow of personal data between Japan and the UK, despite measures being provided for in UK law.

"The Japan adequacy decision is unique in that it is a mutual recognition of the data protection regimes in both the EU and Japan," Voznick said.

"The UK government has indicated in its ‘no deal’ Brexit guidance issued in December 2018 that it '…intends to preserve the effect of these [adequacy] decisions on a transitional basis'. Draft amending legislation for the Data Protection Act 2018 states that adequacy decisions made by the EU prior to exit day for the transfers from the EU or EEA will ‘…be treated as relating to equivalent transfers to or from the United Kingdom'. This assists businesses transferring data to Japan, but the question remains whether Japan will consider the UK data protection’s regime to be ‘essentially equivalent’ for transfers to the UK," she said.

A broader question remains over whether the UK will benefit from a Commission adequacy decision once it leaves the EU, and how and how soon after exit it will be issued.

Voznick said it is likely that, as soon as possible after Brexit, the European Commission will endeavour to adopt an adequacy decision for the UK and have the process completed by the end of 2020. It is possible that the UK could be asked to update its data protection legislation to benefit from an adequacy decision, she said.