Questions & Answers on the Japan adequacy decision

Questions & Answers on the Japan adequacy decision

What is an adequacy decision?

An adequacy decision is a decision taken by the European Commission establishing that a third country provides a comparable level of protection of personal data to that in the European Union, through its domestic law or its international commitments. As a result, personal data can flow safely from the European Economic Area (EEA) (the 28 EU Member States as well Norway, Liechtenstein and Iceland) to that third country, without being subject to any further safeguards or authorisations. This adequacy decision will concern the protections provided under the Japanese Act on the Protection of Personal Information (APPI). It will thus apply to all transfers of personal data to business operators in Japan.

An adequacy decision is one of the tools provided for under the General Data Protection Regulation to transfer personal data from the EU to third countries.

What are the criteria to assess adequacy?

Adequacy does not require the third country's data protection system to be identical to the one of the EU. It is based on the standard of "essential equivalence". It involves a comprehensive assessment of this country's data protection framework, both of the protection guarantees applicable to personal data and of the relevant oversight and redress mechanisms available. The European Data Protection Authorities have established a catalogue of elements that must be taken into account when assessing the adequacy of data protection of another country.

How does Japan meet the adequacy criteria?

Today, the Commission adopted its decision finding that the level of data protection in the EU and Japan are equivalent; in parallel, Japan adopted its equivalent decision. This will create the world's largest area of safe and free data transfer based on a high level of protection. Even though the EU already has unilateral adequacy decisions with several other countries, this is the first time the EU and a third country agreed on a mutual recognition of the adequate level of data protection.

Like the EU, Japan has recently modernised its data protection legislation. This has increased the convergence between the two systems, as reflected in the recognition of data protection as a fundamental right, a common set of safeguards and individual rights, and supervision and enforcement by an independent data protection authority, among other things.

On the EU side, this adequacy finding was decided based on a series of additional safeguards that Japan will apply to the data of Europeans when transferred to their country. These safeguards will bridge certain differences between the two data protection systems: for instance the Japanese definition of sensitive data will be expanded, the exercise of individual rights will be facilitated, and the further transfer of Europeans' data from Japan to another third country will be subject to a higher level of protection. Japan also agreed to establish a system of handling and resolution of complaints, under the supervision of the Japanese data protection authority (the Personal Information Protection Commission), to ensure that potential complaints from Europeans as regards access to their data by Japanese law enforcement and national security authorities will be effectively investigated and resolved.

When will the adequacy decision become applicable?

The Commission launched in September 2018 the process leading to the adoption of the adequacy decision under the General Data Protection Regulation. This included obtaining an opinion from the European Data Protection Board, which brings together all the national data protection authorities, and the green light from a committee composed of representatives of the EU Member States. Now that this procedure has been completed, the Commission adopted the adequacy decision on 23 January 2019. Together with its equivalent decision adopted on the same day by Japan, it will start applying today.

What is the impact of the adequacy decision on the trade agreement with Japan?

For the EU, privacy is not a commodity to be traded. Dialogues on data protection and trade negotiations with third countries have to follow separate tracks.

The Economic Partnership Agreementapplies without prejudice to the each party's legislation in the field of data protection. At the same time, by allowing the safe transfer of personal data between the EU and Japan, the mutual adequacy findings will further facilitate commercial exchanges, thereby complementing and amplifying the benefits of the Economic Partnership Agreement.

Is adequacy limited in time?

There are no time limitations, but adequacy decisions are regularly monitored. The Commission will carry out its first review of the Japan adequacy decision two years after its adoption and subsequently at least every four years.

Adequacy decisions are closely monitored, adapted or even withdrawn in case of developments affecting the level of protection in the third country that had been found adequate.

With which other countries does the EU already have adequacy decisions?

The Commission has adopted adequacy decisions for the following countries and Territories: Andorra, Argentina, Canada, Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the United States (EU-U.S.Privacy Shield). The Japan adequacy decision is the first one adopted since the General Data Protection Regulation became applicable.

The decisions on Canada and the U.S. are "partial" adequacy decisions. The decision on Canada applies only to private entities falling under the scope of the Canadian Personal Information Protection and Electronic Documents Act. The EU-U.S. Privacy Shield framework is a "partial" adequacy decision, as, in the absence of a general data protection law in the U.S., only the companies committing to abiding by the binding Privacy Shield principles benefit from free data transfers.

The Commission is also in the process of negotiating an adequacy decision with Korea.

What are the benefits of the adequacy decision with Japan?

It will both benefit European citizens and businesses. Europeans will benefit from an enhanced level of protection, in line with the high EU privacy standards, when their data is transferred to Japan.

For the first time, the EU and a third country agreed on a reciprocal recognition of the adequate level of protection. European companies will thus benefit from unhindered data transfers from and to Japan as well as from privileged access to its127 million consumers' market. In this way, these adequacy findings will complement and enhance the benefits of the Economic Partnership Agreement which will become effective as of 1 February 2019.

For more information

Press release

Statement

MEMO/19/422