On July 17, 2018, the EU and Japan agreed to recognize each other’s data protection systems as equivalent (the EU Commission’s press release can be found at here). Before the EU Commission will formally adopt its adequacy decision, Japan will introduce the following guarantees:
- additional legal safeguards for individuals in the EU whose personal data are transferred to Japan, with these additional safeguards intended to bridge certain differences between the two data protection regimes. These additional safeguards will, for example, strengthen the protection of sensitive data, the conditions under which EU data can be transferred from Japan to another third country, and the exercise of subjective rights of access and rectification. These provisions will be binding on Japanese companies importing data from the EU and enforceable before Japan’s independent data protection authority (PPC) and the courts.
- a mechanism to handle, investigate, and resolve complaints from Europeans about Japanese authorities’ access to their data. This new mechanism will be administered and monitored by Japan’s independent data protection authority.
The Commission and Japan plan to adopt their respective adequacy decisions in the fall of 2018. Thereafter, personal data will be able to be securely exchanged between the EU and Japan for both commercial and law enforcement purposes.