Questions & Answers on the Japan adequacy decision and data protection - Hoofdinhoud
Q&A
What is an adequacy decision?
An adequacy decision is a decision taken by the European Commission establishing that a third country provides a comparable level of protection of personal data to that in the European Union, through its domestic law or its international commitments. As a result, personal data can flow safely from the European Economic Area (EEA) (the 28 EU Member States as well Norway, Liechtenstein and Iceland) to that third country, without being subject to any further safeguards or authorisations. This adequacy decision will concern the protections provided under the Japanese Act on the Protection of Personal Information (APPI). It will thus apply to all transfers of personal data to business operators in Japan.
An adequacy decision is one of the tools provided for under the General Data Protection Regulation to transfer personal data from the EU to third countries.
What are the criteria to assess adequacy?
Adequacy does not require the third country's data protection system to be identical to the EU's one. It is based on the standard of "essential equivalence". It involves a comprehensive assessment of this country's data protection framework, both of the protections applicable to personal data and of the relevant oversight and redress mechanisms available. The European Data Protection Authorities have established a catalogue of elements that must be taken into account when assessing the adequacy of data protection of another country.
How does Japan meet the adequacy criteria?
Today, the Commission and Japan concluded the negotiations on a reciprocal finding of an adequate level of protection by the EU and Japan. This will create the world's largest area of safe data transfer based on a high level of protection. Even though the EU already has unilateral adequacy decisions with several other countries, this is the first time the EU and a third country agreed on a reciprocal recognition of the adequate level of data protection.
Like the EU, Japan has recently modernised its data protection legislation. This has increased the convergence between the two systems, as reflected in the recognition of data protection as a fundamental right, a common set of safeguards and individual rights, and supervision and enforcement by an independent data protection authority, among other things.
On the EU side, this adequacy finding was decided based on a series of additional safeguards that Japan will apply to the data of Europeans when transferred to their country. These safeguards will bridge certain differences between the two data protection systems: for instance the Japanese definition of sensitive data will be expanded, the exercise of individual rights will be facilitated, and the further transfer of Europeans' data from Japan to another third country will be subject to a higher level of protection. Japan also agreed to establish a system of handling and resolution of complaints, under the supervision of the Japanese data protection authority (the Personal Information Protection Commission), to ensure that potential complaints from Europeans as regards access to their data by Japanese law enforcement and national security authorities will be effectively investigated and resolved.
When will the adequacy decision become applicable?
The Commission will now launch the process leading to the adoption of the adequacy decision under the General Data Protection Regulation. This includes obtaining an opinion from the European Data Protection Board, which brings together all the national data protection authorities, and the green light from a committee composed of representatives of the EU Member States. Once this procedure will have been completed, the Commission will adopt the adequacy decision.
What is the impact of the adequacy decision on the trade agreement with Japan?
For the EU, privacy is not a commodity to be traded. Dialogues on data protection and trade negotiations with third countries have to follow separate tracks.
The Economic Partnership Agreement applies without prejudice to the each party's legislation in the field of data protection. By allowing the safe transfer of personal data between the EU and Japan, the mutual adequacy findings will further facilitate commercial exchanges, thereby complementing and amplifying the benefits of the Economic Partnership Agreement.
Is adequacy limited in time?
There are no time limitations, but adequacy decisions need to be closely monitored and adapted or even withdrawn in case of developments affecting the level of protection in the third country that was has been found adequate. To that end, the Commission will carry out a first review of the adequacy decision two years after its adoption and subsequently every four years.
With which other countries does the EU already have adequacy decisions?
The Commission has adopted adequacy decisions for the following countries and Territories: Andorra, Argentina, Canada, Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the United States (EU-U.S.Privacy Shield).
The decisions on Canada and the U.S. are "partial" adequacy decisions. The decision on Canada applies only to private entities falling under the scope of the Canadian Personal Information Protection and Electronic Documents Act. The EU-U.S. Privacy Shield framework is a "partial" adequacy decision, as, in the absence of a general data protection law in the U.S., only the companies committing to abiding by the binding Privacy Shield principles benefit from easier data transfers.
What are the benefits of the adequacy decision with Japan?
It will both benefit European citizens and businesses. Europeans will benefit from an enhanced level of protection, in line with the high EU privacy standards, when their data is transferred to Japan.
For the first time, the EU and a third country agreed on a reciprocal recognition of the adequate level of protection. This will create the world's largest area of safe transfer of data based on a high level of protection. European companies will thus benefit from unhindered data transfers from and to Japan as well as from privileged access to its market. In this way, these adequacy findings will complement and enhance the benefits of the Economic Partnership Agreement to be signed today.
For more information
MEMO/18/4503
Press contacts:
General public inquiries: Europe Direct by phone 00 800 67 89 10 11 or by email |