Japan's Proposed EU Adequacy Assessment: Substantive Issues and Procedural Hurdles
(2018) 154 Privacy Laws & Business International Report
15 Pages Posted: 25 Jul 2018 Last revised: 28 Aug 2018
Date Written: July 25, 2018
On 17 July 2018 the European Commission announced that it had successfully concluded with Japan ‘their talks on reciprocal adequacy’, and that the Commission would adopt its adequacy finding once ‘relevant internal procedures are complete’. The draft decision is not yet available.
This article commences by noting seven such procedures, and the numerous EU bodies that could have a substantive influence on the final decision, including the European Data Protection Board (EDPB) and the LIBE Committee of the European Parliament. The draft ‘Supplementary Rules’ by Japan’s DPA (the PIPC), on which the decision is substantially based, is explained, and four aspects of them which will benefit European data subjects are set out.
The article then examines the following issues which EU bodies will need to consider: (i) the transparency of adequacy assessment processes; (ii) the applicability of the decision to Japan’s public sector; (iii) whether some personal information transferred from the EU might fall outside Japan’s definition of what is protected; (iv) whether the enforcement of Japan’s data privacy laws does or can meet the standards of the GDPR; (v) whether, even though the Commission is preventing APEC-CBPRs compliance being a basis for onward transfers, its proposed replacement with an almost entirely consent-based mechanism is protective enough; and (vi) whether a law where the key elements of adequacy can benefit only Europeans can be ‘essentially equivalent’.
The path to the EU’s decision on whether Japan’s privacy protections are adequate has many rivers to cross.
Keywords: data protection, privacy, adequacy, European Union, EU, Japan
Suggested Citation: Suggested Citation