On 4 April 2023, the Personal Information Protection Commission of Japan (PPC) and European Commissioner for Justice issued a joint Press Statement on the conclusion of the first review of the Japan-EU Mutual Adequacy Decision. Both sides reiterated the importance of cooperation in the data protection regulation sphere that is becoming increasingly complex to navigate.
Background
The mutual arrangement was reached in 2019, when Japan and the EU recognised each other’s data protection systems as equivalent, allowing personal data to flow freely between them. In order to adopt the adequacy decision, Japan introduced a number of additional safeguards to align itself with EU standards. This development affected data of 127 million people and was hugely beneficial for businesses operating in the EU and Japan. The first review of the adequacy finding was agreed to take place within two years from the date of the notification of the adequacy decision to the EU member states.
The European Commission has not set the same evaluation rules for each of its adequacy decisions so far. Andorra, Argentina, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, and Uruguay only require “monitoring” of the functioning of the adequacy decisions so that the finding remains adequate requiring an action only if there is evidence of discriminatory activity. The following countries require regular “evaluations” requiring more substantive action: South Korea (first review in three years and then every four years) and Switzerland (every three years). Canada required one evaluation of the adequacy decision three years from its notification to EU member states in 2000. Unlike other countries in the white list, the UK’s adequacy decision has an expiration date of 27 June 2025 (four years from its adoption) but its expiration can be extended by the European Commission for another four years.
Past four years – key takeaways
The first review conducted by the EU and Japan demonstrated that the convergence between the countries has increased in the past four years, meaning that the Adequacy Decision has been implemented successfully.
Mieko Tanno, Chairperson of the PPC, commented that the strong cooperation between the parties is due to shared values and that, as part of joint efforts, Japan is committed to promoting the concept of Data Free Flow with Trust globally.
On the other side, Didier Reynders, European Commissioner for Justice, reaffirmed the success of the Mutual Adequacy Decision thus far and reiterated the importance of cooperation to shape the global data protection standards.
Next four years – expansion plans
Both sides recognised the clear benefits offered by the Adequacy Decision and committed to further strengthen the cooperation in the future.
The Press Statement noted that recent reforms of the Japanese data protection framework extended safeguards to new areas such as academia and the public sector which opens potential avenues to expand the scope of the Adequacy Decision. Such expansion would not only boost research and regulatory cooperation between the areas, but also commercial and business opportunities. As agreed back in 2019, the next review will take place in four years.