19 July 2018
The European Commissioner for Justice, Consumers and Gender Equality, Věra Jourová, and the Commissioner of the Personal Information Protection Commission of Japan, Haruhi Kumazawa, issued, on 17 July 2018, a joint statement on the conclusion of talks on an agreement to establish an adequacy decision for personal data transfers between the EU and Japan (‘the Agreement’), along with a Q&A on the same (‘the Q&A’).
Eduardo Ustaran, Partner at Hogan Lovells International LLP highlighted, “This will be the EU’s first adequacy decision since the coming into effect of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’). For this reason, the European Commission (‘the Commission’) needs to follow the criteria set out in Article 45, so it is very helpful that this is happening so soon after the GDPR is in place, as other jurisdictions will be able to gauge what is expected. […] The fact that this will also be a mutual recognition of frameworks signals a new era for global privacy. Japanese law is by no means identical to EU law, but this shows that legal diversity is not in conflict with the protection of data across borders and cultures. Let’s hope that other countries take note and that the EU is keen to pursue this spirit of collaboration on a global scale.”
The general procedure for assessing the adequacy of a data protection framework by the Commission is based on the standard of ‘essential equivalence,’ which comprehensively examines the protections applicable to personal data processing as well as the availability of relevant oversight and redress mechanisms of the third country. According to the Q&A, Japan, like the EU, has recently modernised its data protection legislation, however, Japan is still expected to harmonise certain existing differences such as the expansion of the definition of sensitive data and the establishment of a system which would be supervised by the Personal Information Protection Commission (‘PPC’) and would be responsible for handling and resolving complaints from Europeans.
[The Agreement] shows that legal diversity is not in conflict with the protection of data across borders and cultures
Yumi Watanabe, Counsel at Baker & McKenzie Tokyo, Gaikokuho Joint Enterprise, told DataGuidance, “Whilst restrictions on cross-border transfers of personal data existed before the implementation of the GDPR, the Agreement will make cross-border transfers of personal data run more smoothly. I believe that a number of Japanese companies anticipated the Agreement, [however,] many companies are still struggling to comply with the GDPR in their personal data management […] To bridge the gap between the GDPR and the Act on the Protection of Personal Information, the PPC intends to implement new enforceable rules, providing individuals in the EU with additional safeguards […] which, would be binding on Japanese companies importing data from the EU.”
In addition, the Agreement complements the Economic Partnership Agreement and would contribute to the strategic partnership between Japan and the EU. It will also reaffirm Japan and the EU’s shared values concerning the protection of personal data and strengthen their cooperation. The adequacy decision is expected to be adopted by the Commission in autumn 2018, after obtaining an opinion from the European Data Protection Board and a vote from a committee composed of representatives of the EU Member States.
Ustaran concluded, “This is also good news for the UK as it provides welcome certainty about the standards of data protection that are needed from an adequacy perspective. A mutual recognition of frameworks would also be the obvious way forward for the UK and the EU following Brexit, so this is a hopeful precedent. Much work remains to be done on this front and the UK should consider carefully how Japan has played this all along. The ultimate message is clear, when everyone is open minded and receptive, good things happen for everyone’s benefit.”
CLAUDIA STRUGNELL and NIKOS PAPAGEORGIOU Privacy Analysts