The EU Commission, through a joint statement on 4 July 2017 by Vera Jourova, EU Commissioner for Justice, and Haruchi Kumazawa, a Commissioner of Japan's Personal Information Protection Commission, announced that the process is underway to provide Japan an EU adequacy decision on international data transfers by early 2018. Once approved, Japan will become the 13th country (crediting the US with an adequacy finding for organizations certifying under the Privacy Shield) globally and the first Asian country to be given adequate status by the EU Commission.
Japan's data protection regime had previously been criticized from the EU perspective, but the recent amendment of the Japanese Act on the Protection of Personal Information (APPI) on May 30, 2017 has strengthened its data protection regime. Key aspects of the amended APPI include: (i) a requirement to obtain consent from the data subject to use or disclose "sensitive personal data"; (ii) establishment of a new Personal Information Protection Commission as the centralized data protection authority; (iii) the addition of cross-border transfer restrictions; and (iv) new sanctions for noncompliance, including jail time and fines of up to JPY 500,000. The latest amendments are viewed as ensuring a high level of protection for personal data.
An adequacy decision is an implementing decision taken by the EU Commission in making a determination on whether a third country ensures an "essentially equivalent" level of protection of personal data as a level of protection offered by the EU. Once an adequate level of protection is recognized by the EU Commission, international data transfers can be made without specific authorizations.
The EU Commission has also announced that it has started adequacy talks with South Korea.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
