Will the EU-Japan Data Transfer Partnership Agreement Have Global Influence?

On Jan. 23, 2019, the European Union (EU) issued an adequacy decision regarding free flow of sensitive data with Japan. This is the first adequacy agreement since the General Data Protection Regulation (GDPR) went into effect last May. With countries around the world examining and strengthening their data protection laws, this agreement could be the first of many.

Under the GDPR, the EU can assess other countries' data security initiatives and, if sufficient, issue an adequacy decision that allows uninhibited data transfer between the EU and the other country. This is no small task, as the European Commission has to research the other country's data security measures and submit a proposal, receive input from the European Data Protection Board, gain approval from all EU countries, and ultimately adopt the parameters of the agreement. The other country also has to agree that the EU's system is adequate.

Overview of Japan Agreement

Since the GDPR has stringent data privacy regulations, it is important for other countries seeking data transfer partnerships with the EU to know what constitutes adequacy. While the other country's system does not need to be the same as the GDPR, it needs to be essentially equivalent to pass the test. To meet this bar, Japan implemented extra safeguards including:

1. Creating supplementary rules that address the differences between Japan and EU data security measures. These rules are binding on Japanese organizations and enforceable by Japan's regulatory body and courts. While Japan recently updated their privacy laws to provide more individual protections, these supplementary rules were necessary to cover any areas not consistent with the GDPR. For example, one rule supplements the definition of “sensitive data” to include sex life, sexual orientation, and trade union membership status to better reflect the GDPR's protections.
2. Promising that any personal data obtained for law enforcement or national security will be limited to only what is necessary under the specific circumstances.
3. Creating a procedure for investigating and resolving complaints that Europeans make about a Japanese organization accessing their personal data. Japan now has an independent agency that can monitor these complaints, called the Personal Information Protection Commission.

Benefits and Challenges

All of these things ensure that data flowing to and from Japan will enjoy protections in line with the principles of the GDPR, thus protecting individual privacy. Business in both Japan and EU countries will also greatly benefit from this partnership, which further strengthens their economic relationship. Benefits from the adequacy decision include:

• Free and safe data transfers between organizations situated in Japan and EU countries;
• Direct access to consumers living in Japan and the EU;
• Data access and rights for EU consumers with data in Japan. This includes the right to find out how organizations use their data, the right to request access to their data, and the ability to change errors; and
• Potential for global data governance.

However, there may also be some challenges associated with this partnership. For example, Japan may have to deal with data subject access requests (DSARs) — requests individuals can make to any organization to identify, change and/or delete their personal data. While the adequacy decision does not specifically address DSARs, it does ensure that EU consumers will have similar procedures to make complaints about how Japan uses their personal data and seek redress, if necessary.

Another challenge could be ensuring consistent compliance with the terms of the adequacy decision. The EU will be monitoring the situation closely to ensure that Japan satisfies the terms of the agreement. In two years, there will be a joint review to see how well data transfers are operating. This will include a comprehensive review of the adequacy decision and how it was applied in practice for the first two years. Subsequently there must be a review at least every four years. It is unclear what would trigger a review to take place before each four year mark, however, a significant change in Japan's privacy standards or a large data breach would probably cause the need for an earlier review. The EU can even choose withdraw the adequacy decision if Japan's data privacy model changes or anything comes up that affects the data privacy promised under the agreement.

Japan and the EU also recently implemented an Economic Partnership Agreement this February, which created a large free trade zone. The free trade agreement gets rid of the majority of tariffs on goods traded between the countries. The adequacy decision undoubtedly helped bring this agreement into creation and strengthens the partnership. Uninhibited data flow and free trade between Japan and the EU definitely set the stage for the EU to explore more data and economic partnerships with other nations.

Potential Global Influence

The massive steps in data privacy and transfer will undoubtedly have global repercussions. In fact, other countries are already beginning to follow suit. The EU and South Korea are currently exploring the idea of an adequacy decision, which would create an even bigger flow of data between the EU and other countries.

One thing the European Commission may also decide to do is reevaluate existing adequacy decisions that went into effect prior to the GDPR. The Commission will have to make a decision on whether to amend or withdraw prior decisions, based on each country's current data privacy initiatives. Surely many of the prior decisions fall short of the comprehensive agreement between Japan and the EU. For example, the EU has partial adequacy decisions with the U.S. and Canada that only apply to certain data transfers. If the U.S. does not implement a data privacy law in the near future, the EU may decide to limit or withdraw this agreement.

While only time will tell, this could either lead to global cooperation in the realm of data privacy or an even more isolated approach as countries aim to create their own brand of data security that differs from the GDPR.

*****

Samantha Green, Esq. serves as the Manager of Thought Leadership for Epiq, in which capacity she serves as a subject matter expert on all aspects of electronic discovery and data privacy law, drawing on her more than 15 years of litigation and consulting experience. This article also appeared in Legaltech News, an ALM sibling of Cybersecurity Law & Strategy.