The European Union and Japan have completed their talks on the exchange of personal data, the European Commission announced last week. An official adequacy decision that will allow personal data to be transferred to Japan without additional guarantees is expected to follow.
Transfer of personal data
Under EU law, the personal data of EU citizens cannot simply be transferred to third-party countries (countries outside the European Economic Area) without additional guarantees that the organisations transferring this personal data to third-party countries are ensuring an adequate level of protection.
This can be done in a number of ways; one of them is under an adequacy decision of the European Commission.
If a third-party country offers an adequate level of data protection, the European Commission may render an adequacy decision. This means that the European Commission determines that the data protection of the third-party country is equivalent to the protection extended under the EU’s General Data Protection Regulation (GDPR).
If the European Commission has rendered an adequacy decision for a third-party country, then an organisation wishing to transfer personal data to this third-party country need not provide any additional guarantees. The “EU-US Privacy Shield” framework is an example of an adequacy decision for the transfer of personal data to certain commercial organisations in the United States.
The EU and Japan have been discussing the protection of personal data since January of 2018. In order to meet the European standards for the protection of the personal data of EU citizens, Japan committed to implementing the following additional safeguards in its current system.
After the implementation of the points described above, the European Commission will start the process that will lead to the approval of the draft adequacy decision. It looks like the path to being able to transfer personal data to Japan without additional privacy measures will be cleared within the short term. The European Commission has announced that an adequacy decision for the transfer of personal data to Japan will be rendered this autumn.
Impact of the adequacy decision
The system that the EU and Japan have put into place is a supplement to the Economic Partnership Agreement EU-Japan. This means that European companies will not only be able to take advantage of unrestricted data exchange with Japan as trading partner, but will also gain access to the personal data of Japanese consumers. Moreover, this will establish a safe and stable data exchange environment.
If you have questions about the transfer of personal data to third-party countries or within the EU, contact our Team Privacy. We will be happy to point you in the right direction.