The European Commission has concluded its first review of Japan-EU mutual adequacy decision
On 23 January 2019, the European Commission adopted its adequacy decision in respect of Japan. The effect of that decision was that personal data could flow between the EEA and businesses in Japan without further safeguards, as it was determined that Japanese data protection laws ensured an adequate level of protection for personal data transferred.
The European Commission has now reviewed this adequacy decision, concluding that convergence between the EU and Japan’s data protection frameworks has further increased.
Strengthening of Japan's adequacy decision
It was found that the revised Supplementary Rules issued by the Japan’s Personal Information Protection Commission (“PPC”), which entered into force on 1 April 2023 ("Supplementary Rules") "bridge certain relevant differences" between the Japanese Act on the Protection of Personal Information (“APPI”) and the GDPR. This includes strengthening safeguards in connection with protecting sensitive personal data and onward transfers from Japan of EU data, and clarifying under what circumstances individuals can exercise their individual rights.
Japan has also taken steps to implement new rules relating to pseudonymised personal data as part of its 2020 APPI amendments. These allow for businesses to utilise personal data for statistical purposes but, mirroring the GDPR, emphasise that any personal data received from the EU that is pseudonymised would continue to constitute personal data. The APPI has also been developed to cover both the private and public sector as a comprehensive data protection framework.
Finally, Japan has set up dedicated points of contact for EU data subjects in connection with the processing of their personal data. Commercial operators may reach out to the Inquiry Line and public authorities to the Complaint Mediation Line.
EC conclusions
The European Commission has confirmed that, under Article 45(3) of the GDPR, it will extend its review period of Japan's adequacy decision from two years to four years.
It has also set out the following recommendations as to how Japan may progress further:
- Random checks to be undertaken by the PPC to ensure compliance both with the APPI and the Supplementary Rules.
- Where the PPC provides guidelines on international transfers, these should explicitly explain the specific requirements set out by the Supplementary Rules.
- Ensuring that the point of contact for data subjects to ask questions or complain are accessible e.g. by ensuring these are not just in Japanese.
There are currently no comments from the UK as to whether they agree with the conclusions of the review.
The release by the European Commission can be found here.
