Vera Jourova – Photo EC
(BRUSSELS) – Following the July conclusion of EU-Japan talks on personal data flows, the Commission launched Thursday a procedure for adoption of its decision on data protection adequacy between the two blocs.
“We are creating the world’s largest area of safe data flows,” said the EU’s Justice Commissioner Vera Jourova, as she briefed the College of Commissioners on next steps and the Commission published the draft adequacy decision and the related documents.
This includes additional safeguards that Japan will apply to EU personal data transferred to Japan, as well as commitments regarding access to personal data by Japanese public authorities for law enforcement and national security purposes, guaranteeing that their level of data protection is adequate to that of the EU’s. Japan is going through a similar process to recognise the EU’s data protection framework.
“Personal data will be able to travel safely between the EU and Japan to the benefit of both our citizens and our economies,” said Ms Jourova. “Our partnership will promote global standards for data protection and set an example for future partnerships in this key area.”
Each side is now going through its internal procedures towards the final adoption of its reciprocal adequacy finding.
For the EU, this involves obtaining an opinion from the European Data Protection Board (EDPB) and the green light from a committee composed of representatives of the EU Member States. Once this procedure will have been completed, the Commission will adopt the adequacy decision on Japan.
Key elements of the adequacy decision
To guarantee a level essentially equivalent to European standards, Japan has committed to implementing the following additional safeguards to protect personal data transferred to Japan, before the Commission formally adopts its adequacy decision:
- A set of rules providing individuals in the EU whose personal data are transferred to Japan, with additional safeguards that will bridge several differences between the two data protection systems. These additional safeguards will strengthen, for example, the protection of sensitive data, the conditions under which EU data can be further transferred from Japan to another third country, the exercise of individual rights to access and rectification. These rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.
- The Japanese government also gave assurances to the Commission regarding safeguards concerning the access of Japanese public authorities for criminal law enforcement and national security purposes, ensuring that any such use of personal data would be limited to what is necessary and proportionate and subject to independent oversight and effective redress mechanisms.
- A complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.
Europeans will benefit from strong protection of their personal data in line with EU privacy standards when their data is transferred to Japan, says the EU executive. The arrangement will also complement the EU-Japan Economic Partnership Agreement as European companies will benefit from free data flows with this key commercial partner, as well as from privileged access to the 127 million Japanese consumers. The EU and Japan affirm that, in the digital era, promoting high privacy and personal data protection standards and facilitating international trade must and can go hand in hand.
The draft adequacy decision will now go through the following procedure:
- Opinion from the European Data Protection Board (EDPB)
- Consultation of a committee composed of representatives of the Member States (comitology procedure)
- Update of the European Parliament Committee on Civil Liberties, Justice and Home Affairs
- Adoption of the adequacy decision by the College of Commissioners.
On 17 July this year, the EU and Japan successfully concluded their talks on reciprocal adequacy. They agreed to recognise each other’s data protection systems as adequate, which will allow personal data to be transferred safely between the EU and Japan.
The processing of personal in the EU is based on the General Data Protection Regulation, which provides for different tools to transfer personal data to third countries, including adequacy decisions.
