29. January 2019

29 January 2019 - The European Commission has adopted an adequacy decision on 23 January 2019, according to which the level of data protection is now recognised as equivalent by the EU and Japan. The adequacy decision and its equivalent on the Japanese side will take effect on the same day. The agreement covers the entire European Economic Area.

Until now, Japan, along with many other countries (such as the USA), belonged to the group of unsafe third countries as defined by the GDPR. While there are no additional requirements for data transfers to a safe third country, there are more stringent requirements for data transfers to an unsafe third country. An adequate level of protection must be established in the third country. This can be done through suitable guarantees certified by the European Union. Binding Corporate Rules (BCR) or the use of standard data protection clauses can be considered as such guarantees. This additional hurdle is now no longer necessary for data transfers to Japan. Instead, personal data traffic between the EU and Japan can flow freely on the basis of the adequacy decision.

Before the European Commission adopted the adequacy decision, additional safeguards were included in the Japanese data protection. This is to ensure that personal data transferred from the EU is subject to a level of protection equivalent to the European level of data protection. These include the following safeguards:

• The adoption of provisions (supplementary rules) to compensate for existing differences in data protection rules (for example, in the protection of sensitive data and the conditions regarding the transfer of EU data from Japan to third countries);
• Japanese authorities' access restrictions for law enforcement and threats to national security;
• Procedure for the examination and resolution of complaints by European data subjects about access by Japanese authorities to their data by the independent data protection authority of Japan.

According to the Commissioner for Justice, Consumers and Gender Equality, Věra Jourová, this adequacy decision has created the largest space for secure data flows in the world. Europeans' data would enjoy high data protection standards when transferred to Japan. The Commissioner emphasises above all the advantages for the economy: "In addition, our companies will benefit from privileged access to a market of 127 million consumers. Investing in privacy pays off. This agreement will serve as an example for future partnerships in this key area and help set global standards."

After two years, a first joint review of the framework conditions underlying the adequacy decision shall be carried out. Thereafter, such a joint review shall take place at least every four years.

As ARQIS lawyers, we particularly welcome the adequacy decision. For our numerous Japanese clients, communication with the corporate headquarters in Japan will become easier. The decision thus makes a good contribution to the further deepening of the already excellent relationship.