EU-Japan Adequacy Decision demonstrates that “investing in privacy pays off”

If your organisation transfers data to or from Japan, you may be interested to learn that the recent EU-Japan Adequacy decision permits the free flow of personal data between the EU and Japan. In addition, if your personal data is being transferred to Japan, the decision ensures that the data of EU citizens will receive a high level of protection.

On 23 January, the EU-Japan Adequacy Decision was adopted. The decision stemmed from the European Commission’s decision that Japan offers an adequate level of protection for personal data.

It is a mutual adequacy decision, meaning that it permits the following:

  • The transfer of personal data from the EU to Japan
  • The transfer of personal data from Japan to the EU

The adequacy decision was prompted by recent improvements made by the Japanese Government in relation to its data protection regime. These improvements brought it closer to the standards imposed under the GDPR.

In addition, the Japanese Government introduced Supplementary Rules, to bridge differences between the EU and Japanese data protection regimes. For example, Japan has introduced greater safeguards in relation to sensitive personal data.

What does this mean for EU personal data?

The agreement means that personal data can flow freely between the EU and Japan, with both territories being subject to high privacy standards.

It ensures that when EU personal data is transferred to Japan:

  • The data must be processed only for the purposes for which it was transferred from the EU
  • The data must be processed only as much as is necessary for those purposes
  • The data must be retained for only as long as is necessary for the purposes
  • The data must be kept accurate and updated where necessary
  • The data must not be sent to territories that do not guarantee sufficient data protection standards
  • Appropriate security measures must be implemented

A new complaints mechanism, administered by the Japanese data protection authority, has been introduced for complaints from Europeans regarding access to their personal data by Japanese public authorities.

What happens next?

The EU and Japan will carry out a review of the framework in two years’ time, in order to assess its operation. The review will consider the entirety of the Adequacy Decision, including the safeguards recently introduced by the Japanese Government. After the first review, there will be a periodic review every four years. 

In the words of Commissioner for Justice, Consumers and Gender Equality Věra Jourová, “investing in privacy pays off”.

GDPR & Cyber Security

Cyber security and key changes under the GDPR and UK Data Protection Act 2018 affect almost all businesses. Our online hub contains a wealth of information and insights on what your businesses should be doing to ensure full compliance with the law.

Latest updates from @MacRoberts

  • MacRoberts is recruiting! We currently have a vacancy for a Senior solicitor/associate to join our Private Client… 10 hours ago
  • This week on our new IGTV mini-series, giving an insight into what it’s like to begin a legal career during the pan… 23/06/2021
  • Would you like to work at one of Scotland’s leading law firms? We currently have a number of opportunities availabl… 21/06/2021
  • We currently have a vacancy for a Customer Due Diligence Administrator based in Glasgow or Edinburgh. Please shar… 18/06/2021
  • Maya Forstater received a lot of media attention around her tweets relating to her beliefs about sex, resulting in… 18/06/2021
  • Applications for our traineeships starting in 2023 are now open! Get your legal career off to the best possible sta… 18/06/2021
  • RT @DundeeAndAngus: Leading Scottish commercial law firm, @MacRoberts has advised BAM on the ‘game-changing’ Atlantic Square development in… 16/06/2021
  • This week on our new IGTV mini-series, giving an insight into what it’s like to begin a legal career during the pan… 16/06/2021
  • Self-employed status: What does the Uber case really mean? 🚖 Kenny Scott explains what the recent ruling means for… 16/06/2021
  • What is the Scottish #gin industry doing to improve #sustainability? Following #WorldGinDay celebrations over the w… 15/06/2021
  • The European Commission has adopted & published versions of two new sets of Standard Contractual Clauses. What ch… 15/06/2021
  • What impact could Ireland High Court's decision to reject an action by Facebook to block an inquiry by the Irish… 14/06/2021
  • Wishing all of our followers a happy #WorldGinDay! ICYMI: Earlier this week, we were delighted to catch up with… 12/06/2021
  • We're #hiring! We have a #vacancy for a Senior #Solicitor or Associate to join our IP, Technology & Commercial team… 10/06/2021
  • Dealing with an employee's misconduct when that employee contends it is linked to a disability can be tricky - read… 09/06/2021