Personal Data Transfers to Japan One Step Closer to Adequacy as EU and Japan Conclude Negotiations
On 17 July 2018, the European Union and Japan successfully concluded their negotiations on reciprocal adequacy. These negotiations recognise Japan and the European Union as providing a comparable level of protection of personal data, and clear the way for a seamless transfer of personal data between Japan and the European Union.
Within the framework of these negotiations, Japan has committed to implementing additional safeguards to protect European citizens' personal data (e.g. the definition of sensitive data will be expanded, the exercise of individual rights to access and rectification will be facilitated and the further transfer of Europeans' data from Japan to another third country will be subject to a higher level of protection). These new rules will be binding on Japanese companies importing data from the European Union and enforceable by the Japanese independent data protection authority (PPC) and courts. Japan has also committed to establish a complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.
These measures, once adopted, will cover personal data exchanged between senders and recipients in the EU and Japan for commercial purposes. Both the European Union and Japan will now launch the necessary procedures for the adoption of the formal adequacy decisions. Once these formal decisions have been adopted, personal data will flow from the Member States to Japan without being subject to any further safeguards or authorisations such as binding corporate rules and contractual clauses. For Europe, the adequacy decision must be adopted by the European Commission.