The EU and Japan Announce Data Protection Deal

By Jeremy Feigelson, Jane Shvets, Naomi Aoyama, Jordan Corrente Beck and Dr. Friedrich Popp

On July 17, 2018, the EU Commission and Japan’s central data protection authority announced their agreement to recognize each other’s data protection systems as “equivalent.”[1] The announcement coincided with the signing of a broad trade deal between the Commission and the Japanese government.[2] The mutual adequacy finding marks the first reciprocal recognition of data privacy equivalency between the EU and a third country and, once formalized, “will create the world’s largest area of safe transfers of data based on a high level of protection for personal data.”[3]

The ability to freely transfer data between the EU and Japan should make business transactions within the combined area more cost- and time-efficient, bolstering the impact of the reduced and eliminated tariffs agreed to under the trade deal.

The Details.

The EU Commission (the “Commission”) and Japan’s central data protection authority—the Personal Information Protection Commission (the “PPC”)—have been discussing a mutual adequacy finding since January 2017. Since recent reforms to Japan’s Act on the Protection of Personal Information (“APPI”), the data protection regimes of both the EU—the EU General Data Protection Regulation (“GDPR”)—and Japan have prohibited, with certain exceptions, cross-border transfers of personal data unless the data recipient is located in a country designated as providing an adequate level of protection.

Both the Commission and the PPC have begun the internal procedures necessary to formally designate the data protection regimes of the other as adequate—the Commission by formal adoption of an “adequacy decision” with regard to Japan, and the PPC by designating the EU’s data protection system as “equivalent.”[4]

The agreement includes a commitment by the PPC to implement a set of rules applicable to the transfer of EU personal data into Japan, which the PPC released in September of this year, to become effective on the Commission’s adoption of its adequacy decision.[5] These rules provide additional safeguards benefiting individuals in the EU, including, among others:

  • Classifying certain information, such as sexual history and orientation, or trade union membership, as “sensitive information” under the APPI, which provides for additional protection of such information consistent with GDPR; and
  • Providing a mechanism, to be administered by the PPC, for addressing complaints by Europeans regarding how their information may be accessed by Japanese government authorities.

Impact.

The free transfer of personal data between EU member countries and Japan will relieve EU and Japanese businesses (and other interested parties) from the time and cost of soliciting the consent of individuals to cross-border transfers of their data. When exporting EU data to Japan, companies will no longer have to undertake the burden of implementing standard contractual clauses (SCCs), or engage in the lengthy approval process for binding corporate rules (BCRs). Examples of some possible specific benefits include:

  • Increased flexibility in data storage locations. Affected businesses—say, for example, a Japanese bank with branches in EU member countries—may have more available options in how and where they store data (and potentially more data service providers to choose from).
  • Smoother communications between EU and Japanese affiliates (and more efficient post-deal integration). Global businesses with locations in the EU and Japan or joint ventures and other strategic partnerships between EU and Japanese parties will be able to share data within the combined area according to need and use. For similar reasons, the mutual adequacy finding should facilitate post-acquisition or post-merger business integration.
  • Simplified due diligence. Data protection due diligence should still focus on compliance with the GDPR and APPI, as appropriate (including careful attention to use of third-party vendors and requests to view data protection policies, data maps and other relevant information). Easier transfers of personal data should also mean a simplified diligence process: when transfer of personal data between the EU and Japan is identified, there will no longer be a need to confirm that such transfer is permitted by consent or exception. The mutual adequacy finding also should further facilitate information sharing, to the extent necessary, between EU and Japanese counterparties.

Preparation Tips.

Many of the GDPR- and APPI-preparatory compliance measures that have been recommended for businesses exporting EU or Japanese personal data—such as data mapping or conducting risk assessments—continue to represent best practices. Until the adequacy decisions are fully adopted, businesses exporting data from Japan to the EU or vice versa should remain vigilant to ensure that cross-border transfers are conducted with advance consent or in compliance with GDPR- or APPI-approved mechanisms.

Outlook.

The mutual adequacy finding could herald the adoption by the Commission of other adequacy decisions for East and Southeast Asia—areas the Commission has stated it will focus on going forward. [6] We may also see greater attention to personal data in trade deals. While the Commission has stated that “privacy is not a commodity to be traded,” [7] there is little dispute over the increasingly critical role that data plays in commercial transactions. As the GDPR continues to shake the data protection landscape, and more countries—like Japan—reform their data protection laws to GDPR-like standards, businesses can be expected to continue to increase their focus on ensuring (and requiring) a high level of data protection.

Jeremy Feigelson and Jane Shvets are partners, Naomi Aoyama is Bengoshi International Counsel and Jordan Corrente Beck and Dr. Friedrich Popp are associates at Debevoise & Plimpton LLP.


[1] Joint Statement by Haruhi Kumazawa, Commissioner of the Personal Information Protection Commission of Japan and Věra Jourová, Commissioner for Justice, Consumers and Gender Equality of the European Commission, Tokyo, 17 July 2018, https://www.ppc.go.jp/files/pdf/300717_pressstatement2.pdf.

[2] European Commission Press Release, EU and Japan sign Economic Partnership Agreement, Tokyo, 17 July 2018, http://trade.ec.europa.eu/doclib/press/index.cfm?id=1891.

[3] European Commission Press Release, The European Union and Japan agree to create the world’s largest area of safe data flows, Tokyo, 17 July 2018, http://europa.eu/rapid/press-release_IP-18-4501_en.htm.

[4] European Commission Press Release, International data flows: Commission launches the adoption of its adequacy decision on Japan, Brussels, 5 September 2018, http://europa.eu/rapid/press-release_IP-18-5433_en.htm.

[5] Kojinjōhō no hogo ni kansuru hōritsu ni kakawaru EU ikinai kara jūbunseinintei ni yori iten wo uketa kojin de-ta no toriatsukai ni kansuru hokanteki ru-ru [Supplementary Rules Concerning the Handling of Personal Data Transferred Pursuant to the EU Adequacy Decision under the Act on the Protection of Personal Information], September 2018, https://www.ppc.go.jp/files/pdf/Supplementary_Rules.pdf.

[6] European Commission Press Release, Commission proposes high level of privacy rules for all electronic communications and updates data protection rules for EU institutions, Brussels, 10 January 2017, http://europa.eu/rapid/press-release_IP-17-16_en.htm.

[7] European Commission Fact Sheet, Questions & Answers on the Japan adequacy decision, Tokyo, 17 July 2018, http://europa.eu/rapid/press-release_MEMO-18-4503_en.htm.