The free flow of data between the EU and Japan

On Jan, 23 the EU and Japan reciprocally recognised the adequacy of each other’s data privacy systems, allowing personal data to freely flow between the two economies while guaranteeing a consistent and strong level of data protection.

The adequacy recognition process

This reciprocal adequacy recognition follows a process started in January 2017 when the EU Commission announced, in the Commission’s Communication on Exchanging and Protecting Personal Data in a Globalised World, to be willing to actively engage with key trading partners such as Japan, Korea, India and some Latin American countries which have expressed an interest in obtaining an ‘adequacy status’ under article 45 of the GDPR.

The EU and Japan successfully concluded their negotiations in July 2018 when they agreed to recognise the adequacy of each other’s data privacy systems, provided that Japan put in place additional safeguards to guarantee that the level of protection of EU personal data is not impaired as a result of a cross-border data transfer between the two economies.

The additional safeguards put in place by Japan

The additional safeguards put in place by Japan to guarantee that personal data transferred from the EU enjoys the same level of protection includes:

  1. A set of ‘Supplementary Rules’ - binding on Japanese companies importing EU personal data and enforceable by the Japanese regulator (‘Personal Information Protection Commission’) and courts.
  2. Assurances that any access to personal data by Japanese public authorities for criminal law enforcement and national security purposes is limited to what is strictly necessary and proportionate, and is subject to independent oversight and effective redress mechanisms.
  3. A complaint-handling mechanism - administered and supervised by the Japanese regulator - to investigate and resolve complaints regarding the access to EU individuals’ personal data by Japanese public authorities.

Adequacy status monitoring

In 2021 a first joint review will be carried out by the EU Commission, assisted by the European Data Protection Board (EDPB), to reassess the adequacy status of Japan. This will include a review of the application of the additional safeguards. Afterwards, a review will take place at least every four years.

Data privacy as key economic factor

In light of this, it seems clear that data privacy constitutes one of the key contributing factors to strengthen the economic relationship between the EU and other international partners such as Japan. In fact, the free flow of data between the two economies facilitates EU companies’ access to a market of almost 127 million people. Indeed, not surprisingly this adequacy finding also complements the EU-Japan Economic Partnership Agreement which will enter into force in Feb 2019.

The (economic) importance of such free flow of personal data between jurisdictions and economies is made even clearer by the number of countries (including India, Korea, and China) that the EU Commission is engaging with on data protection adequacy.