On 23 January 2019, the European Commission (Commission) adopted its adequacy decision on Japan (Adequacy Decision) with immediate effect. The Adequacy Decision allows the transfer of personal data without additional safeguards between the EU and Japan, thereby creating “the world’s largest area of safe data flows”.
Under the European General Data Protection Regulation (GDPR) the transfer of personal data to so called third countries is only lawful where an adequate data protection level exists or additional safeguards are implemented. For this, the GDPR provides different tools. The so-called adequacy decision by the Commission is one such tool ensuring that the respective third country offers an adequate level of data protection. Please see for more background information our previous newsletter.
Until today, the European Commission has recognised thirteen countries as providing an adequate level of data protection.
Impact on data transfers between the EU and Japan:
The Adequacy Decision makes the transmission of personal data between the EU and Japan much easier as such transmission is now regarded as an intra-EU data transfer. Hence, no further safeguards, such as Standard Contractual Clauses (SCCs), are needed anymore.
However, the transfer of personal data from the EU to Japan must still be based on a legal basis (e.g. consent, legitimate interests etc.).
Furthermore, European companies still need to conclude data processing agreements (DPAs) with their Japanese data processors in accordance with Art. 28 GDPR. If these data transfers have previously been based on SCCs they need to be updated or replaced by DPAs to fulfil all requirements under the GDPR.
In summary, additional safeguards for the transfer of personal data between the EU and Japan are no longer necessary. However, this does not affect the obligation of European companies to conclude data processing agreements with their Japanese subcontractors.
