EU and Japan aim to create the world's largest area of safe data flows

The European Commission and Japan’s government successfully concluded negotiations on terms that will allow data to flow safely between the EU and Japan. On 17 July 2018, the same day as the signing of the EU’s trade agreement with Japan (“JEFTA”), representatives of both sides agreed to recognize each other’s data protection systems as "equivalent".

The driving factor behind this mutual recognition is European data protection law. Under the General Data Protection Regulation (GDPR), which entered into force on May 2018, the transfer of personal data to third countries outside of the EU is subject to strict conditions. The political agreement reached with Japan lays the foundations of a so-called adequacy decision, by which the Commission determines whether a third country offers an adequate level of data protection. Under the GDPR, such an adequacy decision will enable the uninhibited transfer of data to Japan without necessary further safeguards or authorizations.

The mutual adequacy finding is not a part of the JEFTA Agreement, although negotiations were carried out in parallel. It will complement the trade agreement however, as the opening of telecommunications and e-commerce markets under JEFTA promises a significant increase in data traffic. As Věra Jourová, Commissioner for Justice, Consumers and Gender Equality, stated, "data is the fuel of the global economy and this agreement will allow for data to travel safely between us to the benefit of both our citizens and our economies.” 

To meet the EU’s high standards, Japan’s government has made commitments to implement additional safeguards to protect the personal data of EU citizens, according to the Commission. These include specific conditions under which EU data can be further transferred from Japan to another third country. The Commission also announced that Japan will establish a mechanism to handle complaints from EU citizens regarding access to their data by Japanese public authorities.

The Commission intends to adopt the adequacy decision in autumn after obtaining an opinion from the European Data Protection Board as well as informing the European Parliament Committee on Civil Liberties, Justice and Home Affairs. In accordance with the GDPR, the Commission will continue to periodically review the level of Japan’s data protection.

The EU already has adequacy decisions with a small number of countries, including, for instance, Israel, New Zealand and Switzerland. Regarding the US, a partial adequacy decision is in place, as only US companies committing to the EU-US Privacy Shield principles may benefit from easier data transfer. This framework replaced the controversial Safe Harbor agreement, which the European Court of Justice struck down in 2015. Meanwhile, the new framework has become a target of criticism as well. In a non-legally binding resolution, the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs called on the Commission to suspend the Privacy Shield unless the US administration introduces adequate data protection safeguards by 1 September 2018.

The British government is also seeking a comprehensive deal on continued data transfers, since the UK will be a “third country” under the GDPR as it leaves the EU. It is however currently unclear whether such a deal or an adequacy decision can be secured in time. Companies affected are therefore well advised to take precautionary measures. In particular, this includes considering the other tools provided for by the DSGVO in order to ensure smooth data transfers to the UK after Brexit.

European Commission’s Press Release

Spotlight: Brexit:

Follow Brexit news channel for the latest developments and news.