This is the last step in the procedure launched in September 2018, which included the opinion of the European Data Protection Board (EDPB) and the agreement from a committee composed of representatives of the EU member states. Together with its equivalent decision adopted today by Japan, it will start applying as of today.

Justice, Consumers and Gender Equality Commissioner Věra Jourová said: “This adequacy decision creates the world's largest area of safe data flows. Europeans' data will benefit from high privacy standards when their data is transferred to Japan. Our companies will also benefit from a privileged access to a 127 million consumers' market. Investing in privacy pays off; this arrangement will serve as an example for future partnerships in this key area and help setting global standards.”

The key elements of the adequacy decision

Before the Commission adopted its adequacy decision, Japan put in place additional safeguards to guarantee that data transferred from the EU enjoy protection guarantees in line with European standards. This includes:

• A set of rules (Supplementary Rules) that will bridge several differences between the two data protection systems. These additional safeguards will strengthen, for example, the protection of sensitive data, the exercise of individual rights and the conditions under which EU data can be further transferred from Japan to another third country. These Supplementary Rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.
• The Japanese government also gave assurances to the Commission regarding safeguards concerning the access of Japanese public authorities for criminal law enforcement and national security purposes, ensuring that any such use of personal data would be limited to what is necessary and proportionate and subject to independent oversight and effective redress mechanisms.
• A complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.

The adequacy decisions also complement the Comhaontú Comhpháirtíochta Eacnamaíochta idir an AE agus an tSeapáin which will enter into force in February 2019. European companies will benefit from free data flows with a key commercial partner, as well as from privileged access to the 127 million Japanese consumers. The EU and Japan affirm that, in the digital era, promoting high privacy and personal data protection standards and facilitating international trade must and can go hand in hand.

Na chéad chéimeanna eile

Aiseolas

The adequacy decision – as well as the equivalent decision on the Japanese side –will start applying as of today.

After two years, a first joint review will be carried out to assess the functioning of the framework. This will cover all aspects of the adequacy finding, including the application of the Supplementary Rules and the assurances for government access to data. The Representatives of European Data Protection Board will participate in the review regarding access to data for law enforcement and national security purposes. Subsequently a review will take place at least every four years.

cúlra

The mutual adequacy arrangement with Japan is a part of the EU strategy in the field of international data flows and protection, as announced in January 2017 in the Commission's Communication on Exchanging and Protecting Personal Data in a Globalized World.

The EU and Japan successfully concluded their talks on reciprocal adequacy on 17 July 2018 (see brúigh scaoileadh). They agreed to recognize each other's data protection systems as adequate, allowing personal data to be transferred safely between the EU and Japan.

In July 2017, President Juncker and Prime Minister Abe committed to adopting the adequacy decision, as part of the EU and Japan's shared commitment to promote high data protection standards on the international scene (see ráiteas).

The processing of personal data in the EU is based on the Rialachán Ginearálta um Chosaint Sonraí (GDPR), which provides for different tools to transfer personal data to third countries, including adequacy decisions. The European Commission has the power to determine whether a country outside the EU offers an adequate level of data protection. The European Parliament and the Council can request the European Commission to maintain, amend or withdraw these decisions. 

Tuilleadh eolais                                                                         

The adequacy decision and related documents

Factsheet on the EU-Japan Adequacy Decision

Press release on launch of the adoption procedure (5 Meán Fómhair 2018)

Press release on the conclusions of the adequacy talks (17 2018 Iúil)

Questions & Answers on the Japan adequacy decision

Ráiteas