Will the EU-Japan Data Transfer Partnership Agreement Have Global Influence?

Under the GDPR, the EU can assess other countries' data security initiatives and, if sufficient, issue an adequacy decision that allows uninhibited data transfer between the EU and the other country. This is no small task, as the European Commission has to research the other country's data security measures and submit a proposal, receive input from the European Data Protection Board, gain approval from all EU countries, and ultimately adopt the parameters of the agreement. The other country also has to agree that the EU's system is adequate.

Overview of Japan Agreement

Since the GDPR has stringent data privacy regulations, it is important for other countries seeking data transfer partnerships with the EU to know what constitutes adequacy. While the other country's system does not need to be the same as the GDPR, it needs to be essentially equivalent to pass the test. To meet this bar, Japan implemented extra safeguards including:

1. Creating supplementary rules that address the differences between Japan and EU data security measures. These rules are binding on Japanese organizations and enforceable by Japan's regulatory body and courts. While Japan recently updated their privacy laws to provide more individual protections, these supplementary rules were necessary to cover any areas not consistent with the GDPR. For example, one rule supplements the definition of “sensitive data” to include sex life, sexual orientation, and trade union membership status to better reflect the GDPR's protections.
2. Promising that any personal data obtained for law enforcement or national security will be limited to only what is necessary under the specific circumstances.
3. Creating a procedure for investigating and resolving complaints that Europeans make about a Japanese organization accessing their personal data. Japan now has an independent agency that can monitor these complaints, called the Personal Information Protection Commission.

Benefits and Challenges

All of these things ensure that data flowing to and from Japan will enjoy protections in line with the principles of the GDPR, thus protecting individual privacy. Business in both Japan and EU countries will also greatly benefit from this partnership, which further strengthens their economic relationship. Benefits from the adequacy decision include:

• Free and safe data transfers between organizations situated in Japan and EU countries;
• Direct access to consumers living in Japan and the EU;
• Data access and rights for EU consumers with data in Japan. This includes the right to find out how organizations use their data, the right to request access to their data, and the ability to change errors; and
• Potential for global data governance.

However, there may also be some challenges associated with this partnership. For example, Japan may have to deal with data subject access requests (DSARs) — requests individuals can make to any organization to identify, change and/or delete their personal data. While the adequacy decision does not specifically address DSARs, it does ensure that EU consumers will have similar procedures to make complaints about how Japan uses their personal data and seek redress, if necessary.

Another challenge could be ensuring consistent compliance with the terms of the adequacy decision. The EU will be monitoring the situation closely to ensure that Japan satisfies the terms of the agreement. In two years, there will be a joint review to see how well data transfers are operating. This will include a comprehensive review of the adequacy decision and how it was applied in practice for the first two years. Subsequently there must be a review at least every four years. It is unclear what would trigger a review to take place before each four year mark, however, a significant change in Japan's privacy standards or a large data breach would probably cause the need for an earlier review. The EU can even choose withdraw the adequacy decision if Japan's data privacy model changes or anything comes up that affects the data privacy promised under the agreement.