The European Data Protection Board (EDPB) and the European Commission have reviewed and confirmed the 2019 Adequacy Decision concerning Japan's data protection mechanisms. This guideline aims to present key points and details of this decision.
1. Background and Timeline:
23 January 2019: Initial Adequacy Decision for Japan was made.
Basis: Article 45 of Regulation (EU) 2016/679 (GDPR).
Reason: Japan’s enhanced safeguards ensuring data from the EU is protected to European standards.
3 April 2023: The European Commission completes its review with a positive outcome, noting improved convergence between the Japanese and European data protection systems.
2. Major Provisions and Amendments:
Japanese Act on the Protection of Personal Information (APPI):
Addresses the APPI as supplemented by Supplementary Rules to bridge differences between APPI & GDPR.
Achievements Recognized by the European Commission:
Data Retention and Cross Border Transfers: Incorporation of supplementary rules into the APPI, ensuring consistent application to all personal data.
APPI’s Evolution:
Transformation into a holistic data protection framework.
Now, it covers both public and private sectors.
Under the exclusive authority of the Personal Information Protection Commission (PPC).
Updated Guidelines: PPC's guidelines on international data transfers improve the APPI's accessibility.
Dedicated Contact Points: Established for EU citizens inquiring about their data processing in Japan.
PPC’s Surveillance: Introduction of random checks ensuring adherence to the Supplementary Rules.
3. Critical Issues Highlighted:
Pseudonymized Personal Information:
Exemption from some duties, e.g., data breach reporting.
Emphasis on not using such data for making individual-specific decisions.
Data from the EU remains classified as "personal information" in Japan to ensure continuous protection.
4. European Data Protection Board (EDPB) Actions and Observations:
Commercial Aspects of the Decision:
Positive reception of the "personal data held by the company" definition from the 2020 APPI amendment.
Commendation for the expanded right to object and the duty to inform the PPC and data subjects about significant data breaches.
Expectation of detailed consent requirements for data transfers to third countries.
Close monitoring required for "pseudonymized personal information."
Encouragement for the EU and Japan to draft standardized clauses for consistent and strong safeguards during data transfers.
5. Future Considerations:
EDPB supports the European Commission's plan to revisit the Adequacy Decision in 4 years.
The confirmation of the EU-Japan Adequacy Decision soon after the EU-US Adequacy Decision demonstrates the EU's policy of transparency with third countries concerning personal data, especially in a tech-evolving environment where Artificial Intelligence is becoming increasingly influential.
The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.
Comments