World's 'Largest Area Of Safe Data Flow' Created By Japan And The European Union

The EU-Japan Economic Partnership Agreement between Japan and the European Union ("EU") recently came into force, creating the world's biggest open trading zone that covers 635 million people and almost one-third of the world's total GDP. In the shadow of that agreement, however, another development—the mutual acknowledgment of data protection standards—took place, which should not be overlooked because it sets another world record. On January 23, 2019, the European Commission adopted its adequacy decision on Japan, acknowledging that Japan provides for an adequate level of data protection. Similarly, effective January 23, 2019, the Japanese independent data protection authority, the Personal Information Protection Commission ("PPC"), has also designated countries within the European Economic Area as having an equivalent level of data protection. This mutual acknowledgement created what is being referred to as the "largest area of safe data transfer" in the world.

These developments have important benefits for companies transferring data from the EU to Japan and vice versa, reducing burdens and giving companies greater access to customers. Below, we discuss the developments and describe what companies should consider in the future.

Process of Mutual Acknowledgement

Prior to this mutual acknowledgement, in 2015 Japan amended its privacy protection law, the Act on Protection of Personal Information ("APPI"). Those amendments came into force on May 30, 2017. After the European General Data Protection Regulation ("GDPR") was unveiled in May 2016, the EU Commission proclaimed in January 2017 that it would start a dialogue with the PPC regarding a mutual acknowledgement of data protection standards. The parties successfully reached a final agreement in July 2018, just two months after the GDPR became directly applicable. Following the discussions between the delegates, the PPC has established so-called "Supplementary Rules" under the APPI in order to pave the way to an adequacy decision by the European Commission according to Art. 45 GDPR. In early September 2018, the process by the European Commission to adopt an adequacy decision regarding Japan was initiated, and it ended in the adoption of the adequacy decision on January 23, 2019. On the same day, the equivalency decision was proclaimed by the PPC.

How Is Personal Data From Europe Protected in Japan?

The Supplementary Rules established by the PPC apply to personal data transferred from the EU to Japan on the basis of the European Commission's adequacy decision to ensure that personal data is...