The GDPR came into force in May 2018, affecting countries not only within the EU but also worldwide. The adequacy decision entered into force for the first time between Japan and the EU on 23 January 2019.
The adequacy decision is supposed to be reviewed at least every four years thereafter.
On 4 April 2023, the first review of the Japan-EU mutual adequacy arrangement was concluded.
In this article we provide an overview of the content of the adequacy decision for Japan and the results of the 2023 review.
I.- Adequacy Decision
The transfer, outside the EEA, of the personal data of data subjects located in the EEA is only permitted if the requirements set out by the GDPR are complied with by the controller and processor.
Under the GDPR, transfers should be either (i) transfers on the basis of an adequacy decision (Article 45 of GDPR), (ii) transfers subject to appropriate safeguards (Article 46 of GDPR) or (iii) derogations for specific situations (Article 49 of GDPR).
An adequacy decision is one method for transfers and allows personal data to be transferred outside the EEA without the need for special procedures.
II.- Supplementary Rules
At the same time of the adoption of the adequacy decision relative to Japan, supplementary rules have been established that only apply to the processing of data transferred under the adequacy decision.
These are mainly as follows.
(i) With regard to information on sex life, sexual orientation or trade unions, the business operator handling personal information shall treat such information in the same way as sensitive personal information under Article 2.3 of the Act on the Protection of Personal Information in Japan (hereinafter referred to as the “APPI”).
(ii) Data retention periods have been removed.
(iii) The recipient of the personal data may not provide such data for any additional purpose beyond the purpose of use for which it was supplied.
(iv) The transfers can only be made in accordance with Article 24 of the APPI, for example, by obtaining the consent of the data subject in advance, as a restriction on the provision of personal data to third parties located in foreign countries.
III.- Review of the adequacy decision and future issues.
In Japan, the APPI was amended in 2020 and 2021; the European Data Protection Board welcomed amendment of the APPI in 2020 and 2021, especially the partial legalisation of the supplementary rules (removal of the six-month retention requirement in the definition of the personal data held by the business). And the Board also welcomed the expanded powers of Japanese Personal Information Protection Commission.
Based on this review, the supplementary rules were also partially amended in 2023.
The one of the major amendment points of the supplementary rules is the deletion of point (ii) mentioned above in section II.- Supplementary Rules.
The APPI has also introduced the concept of “pseudonymised personal information” in its amendments. It was decided that pseudonymised personal information obtained by processing personal data provided from within the EU on the basis of a sufficiency certification will be handled in accordance with Article 41 of the APPI.
However, the scope of application of the adequacy decision remains limited to the scope to which the APPI applies even after the review, and data transfers by Japanese public organisations, such as independent administrative institutions remain exempt, and this remains a future issue for the EU-Japan adequacy decision.
Satoshi Minami
Vilá Abogados
For more information, please contact:
1st March 2024
