Der Europäische Datenschutzausschuss (EDSA; European Data Protection Board, der Nachfolger der Artikel-29-Datenschutzgruppe) hat sich zum Entwurf des Angemessenheitsbeschlusses der Kommission für Japan geäussert (Opinion 28/2018 regarding the European Commission Draft Implementing Decision on the adequate protection of personal data in Japan, 5. Dezember 2018). Der EDSA misst diesem Beschluss grosse Bedeutung bei, weil er als erster Angemessenheitsbeschluss unter der DSGVO Präjudizwirkung haben wird; entsprechend detailliert ist die Prüfung des EDSA ausgefallen.
Der EDSA fasst das Ergebnis der Prüfung wie folgt zusamme
[…] The EDPB welcomes the efforts made by the European Commission and the Japanese PPC to align as much as possible the Japanese legal framework to the European one. The improvements brought in by the Supplementary Rules to bridge some of the differences between the two frameworks are very important and well received.However, following a careful analysis of the Commission’s draft adequacy decision as well as of the Japanese data protection framework, the EDPB notices that a number of concerns, coupled with the need for further clarifications, remain. Further, this specific type of adequacy combining an existing national framework with additional specific rules also raises questions about its operational implementation. In light of the above, the EDPB recommends the European Commission to address the concerns and requests for clarification raised by the EDPB and provide further evidence and explanations regarding the issues being raised. The EDPB also invites the European Commission to conduct a review of this adequacy finding (at least) every two years and not every four years as suggested in the current draft adequacy decision.