On 17 July 2018, the European Union (EU) successfully reached an agreement in principle with Japan in relation to an adequacy decision that will allow for secure data flows between the EU and Japan, to the benefit of both European and Japanese citizens and businesses. This agreement was reached on foot of the belief that international trade must coincide with high privacy standards and affirms the extent of the General Data Protection Regulation’s (GDPR) regulatory and economic impact. 

While several unilateral agreements have previously been reached, this is the first reciprocal adequacy agreement between the EU and a third country. 

Once formalised, the adequacy arrangement will provide European companies with a legitimate basis to transfer personal data between the EU and Japan. To adopt the adequacy decision, both the EU and Japan need to complete their respective internal procedures.

For the EU, this will involve the approval of the draft adequacy decision by the College of EU Commissioners, receiving an opinion from the European Data Protection Board, obtaining approval from a committee composed of representatives of EU Member States and updating the European Parliament Committee on Civil Liberties, Justice and Home Affairs. 

Japan must introduce a set of rules providing individuals with additional safeguards, to be enforced by Japan’s independent data protection authority and the Japanese courts.A European Commission press release on this topic has indicated that the aim of such additional Japanese safeguards is to strengthen: the conditions under which EU personal data can be transferred from Japan to another third country; the protection of sensitive data; and the exercise of individual rights to access and rectification. A complaint-handling mechanism must also be established in Japan, to be administered and supervised by Japan’s independent data protection authority. These procedural moves will follow the amendments recently made to Japan’s legislation on the Protection of Personal Information.

Věra Jourová, Commissioner for Justice, Consumers and Gender Equality expects this agreement to “shape the global standards for data protection and show common leadership in this important area”. The decision, which we have previously reported on, will be of particular importance to the UK. The transfer of personal data between the UK and the EU still needs to be addressed as part of the Brexit process. Possible solutions open to the UK include a similar unilateral adequacy decision or a separate bilateral treaty. The UK Government invited the European Commission to grant an early ‘adequacy plus’ decision (for details see the White Paper published on 12 July 2018). The UK are eager to reach an agreement that goes further than a typical adequacy decision and is focusing on stability and transparency, together with regulatory cooperation. Some in the UK are understandably concerned that following Brexit, without a bilateral agreement, UK companies may need to adopt other more cumbersome and difficult mechanisms in order to transfer data between the UK and the EU. 

As of 5 September 2018, the EU Commission is pushing forward and has launched the internal procedure for the adoption of its adequacy decision.

For further information, please contact John O’Connor or you usual William Fry contact.

Contributed by: John O’Connor 

Follow us on Twitter @WFIDEA and @WilliamFryLaw