Data transfers to countries outside the European Economic Area are only legal if –in addition to the requirement of a legal basis or the data subject’s consent– an adequate level of data protection in that country can be guaranteed. One way this can be achieved is an Adequacy Decision of the European Commission. The Commission has in the past issued such decisions for Andorra, Argentina, Canada (commercial organizations), Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay. Now, the EU Commission may include Japan in its Adequacy Decision.
On May 30, 2017, the new Japanese Act on Protection of Personal Information (APPI) has entered into force, which brings about considerable changes. Interestingly, Japanese Data Protection Law now requires that, without the data subject’s consent, personal data may only be transferred to “safe countries” as per the newly introduced white-list.
At the G7 Summit in Ise Shima, international data transfers have been part of the discussions, and in their joint declaration of July 6, 2017, Shinzo Abe, Prime Minister of Japan, and Jean-Claude Juncker, President of the European Commission, have stressed the importance of a high level of privacy and security of personal data and that with the recent reforms of their privacy legislations, the EU and Japan had further increased the convergence between their two systems, which “offers new opportunities to facilitate data exchanges, including through a simultaneous finding of an adequate level of protection by both sides.” The EU Commission and the Japanese Government stated that efforts would be intensified towards achieving this goal by early 2018.
According to a publication on the website of the Japanese Personal Information Protection Commission (PPC) “Concerning the Smooth and Mutual Transfer of Personal Data Between Japan and the European Union”, in a meeting held on July 3, 3017, PPC Commissioner Haruhi Kumazawa and EU Commissioner Věra Jourová had affirmed measures to be taken towards establishing a framework regarding the mutual transfer of personal data.
It would therefore not be surprising to see a mutual recognition with Japan on the EU’s adequacy list and the EU on Japans “white-list” of safe jurisdictions in the near future. We are following the development with interest and will continue to report.