On July 17, the European Commission (the “Commission”) announced that the European Union and Japan successfully concluded talks on reciprocal adequacy and agreed to recognize each other’s data protection systems as equivalent. In its press release, the Commission explains that this adequacy agreement will create “the world’s largest area of safe transfers of data based on a high level of protection for personal data.”
The General Data Protection Regulation (“GDPR”) came into effect as of May 25 of this year. Under the GDPR, “adequacy” is the simplest way for companies to lawfully perform cross-border transfers of personal data. With the adequacy arrangement, companies will be able to provide secure and stable data flows between the EU and Japan in a straightforward manner while “promoting high privacy standards and facilitating international trade.” In addition to personal data exchanged for commercial purposes, the agreement will apply to personal data exchanged for law enforcement purposes.
There are key tasks to be achieved by the Japanese and European administrations before the reciprocal adequacy decision becomes applicable. Japan has amended the Act on Protection of Personal Information (“APPI”) effective as of May 30, 2017, a year in advance of the arrival of the GDPR. Although the amended APPI resembles the GDPR in many ways, there are certain GDPR standards Japan must implement before the Commission can formally adopt the adequacy decision. For example, Japan will need to implement additional safeguards to strengthen the protection of sensitive data, the conditions under which EU data can be onward transferred from Japan to a non-EU third country, and the individual rights to access and rectification.
While Japan implements additional safeguard standards and finalizes its adequacy finding under the APPI, the Commission will launch the process leading to the adoption of the adequacy decision under the GDPR. The adoption of the adequacy decision is expected to occur in the fall of this year.
For more information on the Japan adequacy decision, see the Fact Sheet available at the Commission’s website.
