On January 23, 2019, the European Commission announced its decision to adopt adequacy status with Japan for transfers of personal data.  Pursuant to the European Union’s (EU) General Data Protection Regulation (GDPR), this decision will allow personal data to flow freely between the 28 EU countries, three additional European Economic Area member countries (Norway, Liechtenstein, and Iceland), and Japan, without the need for additional data protection safeguards or derogations.  Japan adopted an equivalent decision with the EU on January 22, 2019.  These reciprocal findings of adequacy will create the largest area of safe data flows in the world.

The Commission highlighted the following safeguards that Japan initiated prior to the Commission’s determination of adequacy:

• Implementation of a set of Supplementary Rules designed to bridge the differences between  EU and Japanese data protection systems, including with respect to the protection of sensitive data, the exercise of individual rights, and the conditions under which EU data can be transferred from Japan to another country (“onward transfers”).  According to the Commission, these Supplementary Rules “will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.”

• Assurances from the Japanese government to the Commission that any access to EU personal data by Japanese public authorities for criminal law enforcement and national security purposes would be “limited to what is necessary and proportionate and subject to independent oversight and effective redress mechanisms.”

• Adoption of a complaint-handling mechanism, administered and supervised by the Japanese independent data protection authority, to investigate and resolve complaints from EU citizens regarding access to their personal data by Japanese public authorities.

Implemented in May 2018, the GDPR requires that EU citizens’ personal data be transferred to countries with an adequate data protection status.  Japan joins only 12 other countries – Andorra, Argentina, Canada, Switzerland, Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, the United States (under the EU-U.S. Privacy Shield), and Uruguay – as providing adequate protection under the EU’s data privacy framework.

The Commission’s adequacy decision will complement the EU-Japan Economic Partnership Agreement, which was signed on July 17, 2018, following several years of negotiations between the jurisdictions. The EU-Japan Economic Partnership Agreement will enter into force in February 2019.