If your organisation transfers data to or from Japan, you may be interested to learn that the recent EU-Japan Adequacy decision permits the free flow of personal data between the EU and Japan. In addition, if your personal data is being transferred to Japan, the decision ensures that the data of EU citizens will receive a high level of protection.

On 23 January, the EU-Japan Adequacy Decision was adopted. The decision stemmed from the European Commission’s decision that Japan offers an adequate level of protection for personal data.

It is a mutual adequacy decision, meaning that it permits the following:

  • The transfer of personal data from the EU to Japan
  • The transfer of personal data from Japan to the EU

The adequacy decision was prompted by recent improvements made by the Japanese Government in relation to its data protection regime. These improvements brought it closer to the standards imposed under the GDPR.

In addition, the Japanese Government introduced Supplementary Rules, to bridge differences between the EU and Japanese data protection regimes. For example, Japan has introduced greater safeguards in relation to sensitive personal data.

What does this mean for EU personal data?

The agreement means that personal data can flow freely between the EU and Japan, with both territories being subject to high privacy standards.

It ensures that when EU personal data is transferred to Japan:

  • The data must be processed only for the purposes for which it was transferred from the EU
  • The data must be processed only as much as is necessary for those purposes
  • The data must be retained for only as long as is necessary for the purposes
  • The data must be kept accurate and updated where necessary
  • The data must not be sent to territories that do not guarantee sufficient data protection standards
  • Appropriate security measures must be implemented

A new complaints mechanism, administered by the Japanese data protection authority, has been introduced for complaints from Europeans regarding access to their personal data by Japanese public authorities.

What happens next?

The EU and Japan will carry out a review of the framework in two years’ time, in order to assess its operation. The review will consider the entirety of the Adequacy Decision, including the safeguards recently introduced by the Japanese Government. After the first review, there will be a periodic review every four years. 

In the words of Commissioner for Justice, Consumers and Gender Equality Věra Jourová, “investing in privacy pays off”.