The European Union and Japan have completed their talks on the exchange of personal data, the European Commission announced last week. An official adequacy decision that will allow personal data to be transferred to Japan without additional guarantees is expected to follow.
Transfer of personal data
Under EU law, the personal data of EU citizens cannot simply be transferred to third-party countries (countries outside the European Economic Area) without additional guarantees that the organisations transferring this personal data to third-party countries are ensuring an adequate level of protection.
This can be done in a number of ways; one of them is under an adequacy decision of the European Commission.
Adequacy decisions
If a third-party country offers an adequate level of data protection, the European Commission may render an adequacy decision. This means that the European Commission determines that the data protection of the third-party country is equivalent to the protection extended under the EU’s General Data Protection Regulation (GDPR).
If the European Commission has rendered an adequacy decision for a third-party country, then an organisation wishing to transfer personal data to this third-party country need not provide any additional guarantees. The “EU-US Privacy Shield” framework is an example of an adequacy decision for the transfer of personal data to certain commercial organisations in the United States.
Japan
The EU and Japan have been discussing the protection of personal data since January of 2018. In order to meet the European standards for the protection of the personal data of EU citizens, Japan committed to implementing the following additional safeguards in its current system.
- These are rules granting EU citizens extra guarantees, to bridge the gaps between the two privacy systems. For example, in Japan the definition of special categories of personal data is being expanded. Also, the conditions on the basis of which Japan can forward the personal data of EU citizens to other third-party countries are being made more strict. Further, more options for the exercise of individual rights are being added, such as the right of access and rectification. These are binding rules that can also be enforced by the Japanese courts and regulatory authorities.
- A complaint system for handling complaints of EU citizens concerning the transfer of personal data and access by the Japanese government to this data.
After the implementation of the points described above, the European Commission will start the process that will lead to the approval of the draft adequacy decision. It looks like the path to being able to transfer personal data to Japan without additional privacy measures will be cleared within the short term. The European Commission has announced that an adequacy decision for the transfer of personal data to Japan will be rendered this autumn.
Impact of the adequacy decision
The system that the EU and Japan have put into place is a supplement to the Economic Partnership Agreement EU-Japan. This means that European companies will not only be able to take advantage of unrestricted data exchange with Japan as trading partner, but will also gain access to the personal data of Japanese consumers. Moreover, this will establish a safe and stable data exchange environment.
If you have questions about the transfer of personal data to third-party countries or within the EU, contact our Team Privacy. We will be happy to point you in the right direction.
