Adequacy of Japan officially recognised
On 23 January 2019, the EU Commission announced its decision that Japan ensures an adequate level of data protection. With this decision, it is now possible to freely transfer personal data from the EEA to Japan without any further requirements.
Transfers of personal data originating from the European Economic Area (“EEA”) to third countries have been strictly regulated by European data protection rules for many years. Under these rules, only a few countries have been recognised so far as offering an equivalent protection to that applicable in the European Union, i.e. the General Data Protection Regulation (2016/679) (“GDPR”).
Such recognition means that these countries are deemed to be an EU Member State in relation to personal data transferred to them. In other words, the transfer of personal data to these adequate countries are no longer subject to the requirements of Articles 46 and following of the GDPR (such as the adoption of binding corporate rules or the execution of the standard contractual clauses adopted by the EU Commission).
Today, the EU Commission announced its decision recognising the adequacy of Japan. It starts applying immediately. It applies for all personal data transfers from the EEA (all EU Member States plus Iceland, Liechtenstein and Norway) to Japan.
EDPB advice
The decision is the final step in a procedure that was launched in early 2017 and which culminated with a draft decision of the EU Commission in September 2018 (read more about it on our DigiLinks blog). It is the result of long lasting negotiations between the EU and Japan. The European Data Protection Board (“EDPB” - the independent EU body composed of the supervisory authorities of all Member States), provided its advice on the draft decision on 5 December 2018. The EU Commission has taken on board the comments made by the EDPB in its final decision
A unique position
With this decision, Japan can now be added to the select list of countries which have so far been recognized by the EU Commission as providing adequate protection (such as Canada and Switzerland).
It is also the first time that such a recognition takes place under the GDPR and in a reciprocal manner. As of today, Japan has indeed adopted an equivalent decision for data transferred to the EEA.
This major milestone further strengthens the recently adopted Economic Partnership Agreement (EPA) between the EU and Japan, which will enter into effect on 1 February 2019 and which will create an open trading area covering over 600 million people and almost one third of the world’s GDP.
